Add typed account and password settings

- Add admin account list, create, role, delete, and password workflows
- Execute identity-checked mutations through the existing dispatcher
- Bound queued credential lifetime and wipe transient secrets
- Add explicit password generation with saved-value acknowledgement
- Handle self-revocation and uncertain outcomes without automatic
  retries
- Register optional account routes without disrupting terminal
  transports
- Expand host regressions and document contracts and pending target
  checks

Validated host suites and pio run; hardware validation remains pending.

src/user_database.h

@@ -105,6 +105,28 @@ esp_err_t user_database_recover_from_legacy(
     const user_database_legacy_credentials_t *legacy);
 esp_err_t user_database_get_snapshot(user_database_snapshot_t *snapshot);
 
+/* Compact secret-free list, zero-wait mutex acquisition; no key material. */
+typedef struct {
+    uint32_t user_id, auth_generation;
+    user_role_t role;
+    char username[USER_DATABASE_USERNAME_CAPACITY + 1U];
+} user_database_account_t;
+typedef struct {
+    size_t count;
+    user_database_account_t users[USER_DATABASE_MAX_USERS];
+} user_database_accounts_t;
+esp_err_t user_database_get_accounts(user_database_accounts_t *accounts);
+/* Compare target identity under the mutation lock, before candidate/commit.
+ * ESP_ERR_NOT_FOUND means absent or stale; existing account invariants apply. */
+esp_err_t user_database_delete_current(const user_database_account_t *expected);
+esp_err_t user_database_set_role_current(const user_database_account_t *expected,
+                                         user_role_t role);
+esp_err_t user_database_set_password_current(const user_database_account_t *expected,
+                                             const uint8_t *password, size_t password_length);
+/* RNG only: no database initialization, account mutation or persistence. Caller
+ * owns/wipes successful output; failures clear it. Same generator as CLI. */
+esp_err_t user_database_generate_password_value(user_database_generated_password_t *generated);
+
 esp_err_t user_database_authenticate_password(
     const uint8_t *username, size_t username_length,
     const uint8_t *password, size_t password_length,