Review requests, generate passwords, approve users, and send email notices.
Admin session required (JWT claim user_role = admin).