web: moderate accounts, accept 12MB uploads, put SAVE under CREATE

- /admin User account rows gain BLOCK/UNBLOCK, REMOVE/RESTORE and DELETE.
  Blocked = cannot sign in (sessions swept), removed = hidden from the strip
  and cannot sign in, both reversible; DELETE drops the account with its
  photos and recipes and unlinks the files. An allowlisted account is never
  a target, so an admin cannot moderate or delete itself.
- Photo uploads move from a 3MB API cap / 4m nginx cap to 12MB / 16m, and
  the browser shrinks an oversized still before sending it (2048px JPEG,
  avatars 512px) so the declared type still matches the sniffed bytes.
- The studio SAVE leaves the top bar and sits under the CREATE RECIPES tab,
  labelled SAVE RECIPES.

docker/frontend/src/styles/app.css

@@ -400,6 +400,11 @@ input[type="range"] { width: 100%; accent-color: var(--accent); }
 }
 .adm-face img { display: block; width: 100%; height: 100%; object-fit: cover; }
 .adm-filter { display: flex; align-items: center; gap: 8px; }
+/* Moderation state next to the account name, and the row's own actions: the
+   three controls sit side by side and the pane scrolls when it runs out. */
+.adm-badge-warn { margin-left: 6px; color: var(--danger); font-size: 11px; }
+.adm-table td:last-child { white-space: nowrap; }
+.adm-table td:last-child .btn { margin-right: 6px; }
 .adm-form { display: flex; flex-direction: column; gap: 8px; max-width: 360px; }
 .field-label { font-size: 11.5px; color: var(--text-dim); }