feat(admin): fix the tab bar on Users + Configuration pages

Apply the fixed-chrome pattern to the two admin pages with a horizontal
tab bar: the tabs (and Config's intro) pin in the shell's fixed band while
the tab content scrolls under them. Config's floating save bar is
unaffected. Suite 15/15, tsc + knip clean.

frontend/src/components/AdminUsers.tsx

@@ -9,6 +9,7 @@ import Tooltip from "./Tooltip";
 import { Section } from "./ui/form";
 import { useConfirm } from "./ConfirmProvider";
 import Tabs, { usePersistedTab } from "./Tabs";
+import { PageToolbar } from "./PageShell";
 
 // Admin-only user & access management: roles, access requests (the Invite whitelist), and the
 // demo whitelist + reset. Each section is its own tab (persisted across reloads); the Access tab
@@ -26,12 +27,19 @@ export default function AdminUsers({ me }: { me: Me }) {
   ];
   const active = tabs.some((x) => x.id === tab) ? tab : "roles";
   return (
-    <div className="p-4 max-w-3xl w-full mx-auto">
-      <Tabs tabs={tabs} active={active} onChange={setTab} />
-      {active === "roles" && <UsersRoles me={me} />}
-      {active === "access" && <AdminInvites />}
-      {active === "demo" && <AdminDemo />}
-    </div>
+    <>
+      {/* The tab bar is fixed chrome; the tab content scrolls under it. */}
+      <PageToolbar>
+        <div className="px-4 pt-3 max-w-3xl w-full mx-auto">
+          <Tabs tabs={tabs} active={active} onChange={setTab} />
+        </div>
+      </PageToolbar>
+      <div className="px-4 pb-4 pt-3 max-w-3xl w-full mx-auto">
+        {active === "roles" && <UsersRoles me={me} />}
+        {active === "access" && <AdminInvites />}
+        {active === "demo" && <AdminDemo />}
+      </div>
+    </>
   );
 }