feat(admin): add users directly with admin-set password + phone field

- POST /api/admin/users: if password supplied → createUser (instant, email_confirm:true); else inviteUserByEmail (existing flow)
- password validated ≥8 chars; never logged in audit_log
- profile update now also saves phone number
- UI: mode toggle (Invite by email / Add directly), phone input always visible, password input shown only in 'Add directly' mode

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CPf5Rc8QPx6V8KLEEgfKEQ

app/api/admin/users/route.ts

@@ -22,13 +22,17 @@ export async function POST(request: NextRequest) {
   const { supabase, user } = await requireAdmin()
   if (!user) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
-  const body: { email?: string; name?: string; role?: string; site_id?: string } =
+  const body: { email?: string; name?: string; phone?: string; role?: string; site_id?: string; password?: string } =
     await request.json().catch(() => ({}))
   const email = (body.email ?? '').trim().toLowerCase()
   if (!email || !email.includes('@'))
     return NextResponse.json({ error: 'Valid email required' }, { status: 422 })
   if (body.role && !isValidRole(body.role))
     return NextResponse.json({ error: 'Invalid role' }, { status: 422 })
+  const password = (body.password ?? '').trim()
+  const directCreate = password.length > 0
+  if (directCreate && password.length < 8)
+    return NextResponse.json({ error: 'Password must be at least 8 characters' }, { status: 422 })
 
   let admin
   try {
@@ -40,32 +44,55 @@ export async function POST(request: NextRequest) {
     )
   }
 
-  const { data: invited, error: inviteError } = await admin.auth.admin.inviteUserByEmail(email, {
-    data: { full_name: body.name ?? '' },
-  })
-  if (inviteError || !invited?.user)
-    return NextResponse.json({ error: inviteError?.message ?? 'Invite failed' }, { status: 500 })
+  // Branch: admin-typed password (instant) vs email invite (link required)
+  let newUserId: string
+  if (directCreate) {
+    const { data: created, error: createError } = await admin.auth.admin.createUser({
+      email,
+      password,
+      email_confirm: true,
+      user_metadata: { full_name: body.name ?? '' },
+    })
+    if (createError || !created?.user)
+      return NextResponse.json(
+        { error: createError?.message ?? 'User creation failed' },
+        { status: (createError as { status?: number } | null)?.status ?? 500 },
+      )
+    newUserId = created.user.id
+  } else {
+    const { data: invited, error: inviteError } = await admin.auth.admin.inviteUserByEmail(email, {
+      data: { full_name: body.name ?? '' },
+    })
+    if (inviteError || !invited?.user)
+      return NextResponse.json({ error: inviteError?.message ?? 'Invite failed' }, { status: 500 })
+    newUserId = invited.user.id
+  }
 
-  // handle_new_auth_user trigger creates the profile row; set role/site on top of it
+  // handle_new_auth_user trigger creates the profile row; set fields on top of it
   const { error: profileError } = await admin
     .from('users')
     .update({
       name: body.name ?? '',
+      phone: (body.phone ?? '').trim() || null,
       role: body.role ?? 'reporter',
       site_id: body.site_id ?? null,
     })
-    .eq('id', invited.user.id)
+    .eq('id', newUserId)
   if (profileError)
-    return NextResponse.json({ error: 'Invite sent but profile update failed' }, { status: 500 })
+    return NextResponse.json(
+      { error: `${directCreate ? 'User created' : 'Invite sent'} but profile update failed` },
+      { status: 500 },
+    )
 
+  // password is never logged
   await supabase.rpc('write_audit_log', {
     p_table_name: 'users',
-    p_record_id: invited.user.id,
-    p_action: 'invited',
+    p_record_id: newUserId,
+    p_action: directCreate ? 'created' : 'invited',
     p_new_value: { email, role: body.role ?? 'reporter', site_id: body.site_id ?? null },
   })
 
-  return NextResponse.json({ id: invited.user.id }, { status: 201 })
+  return NextResponse.json({ id: newUserId }, { status: 201 })
 }
 
 export async function PATCH(request: NextRequest) {