- POST /api/admin/users: if password supplied → createUser (instant, email_confirm:true); else inviteUserByEmail (existing flow) - password validated ≥8 chars; never logged in audit_log - profile update now also saves phone number - UI: mode toggle (Invite by email / Add directly), phone input always visible, password input shown only in 'Add directly' mode Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CPf5Rc8QPx6V8KLEEgfKEQ