docs: phase 3b.3 user-management session log + roadmap (Phase 3 complete)

docs/roadmap.md

@@ -193,8 +193,14 @@ Each phase keeps the system working and is its own spec → plan → build cycle
   worker/type/activity filters, headline totals and breakdowns per worker/activity/type) backed by
   `GET /api/admin/report` (completed-only, JS aggregation), plus an all-users filtered CSV via
   `GET /api/admin/export` — a shared `buildSessionsCsv(rows, {includeWorker})` now serves both the
-  worker self-export and the admin export. **3b remaining:** user management
-  (better-auth `/api/auth/admin/*`).
+  worker self-export and the admin export.
+  **3b·3 implemented** (plan `docs/superpowers/plans/2026-06-24-phase-3b3-user-management.md`):
+  the admin **Gebruikers** screen — list users (role + active/inactive status), create, set role,
+  reset password, deactivate/reactivate — backed by a new `/api/admin/users*` router (a shared
+  `adminGuard` middleware; `role`/`banned` as direct column updates, create + reset-password via
+  better-auth). Server-side lockout guards (no self-deactivate, no self-demote, last-active-admin
+  invariant), `adminGuard` also rejects banned admins, and deactivate revokes the user's sessions.
+  **Phase 3b and the Phase 3 admin panel are complete.**
   Activity management (add/edit/delete handelingen + their `insole_types`) was removed from the
   worker client in the Phase 2 follow-up because it is admin-only; it must be **ported here**. The
   backend already exists (`/api/activities` writes are admin-gated; `useActivities`/the legacy