design-15 S4a: adopted-track per-line user write path

[lr00rl]

Summary

design-15 D3 server slice (adopted track first; managed re-render deferred per D6):

• users-admin.plan_add / plan_remove (in-core, core-backed — same pattern as netguard's plan): compiles a pending approval. Plan is redacted (op/line/user/protocol/credential SHA — no secrets); Action binds the exact credential SHA-256.
• Apply: applyScriptFor routes singbox-lineuser approvals to a script that re-derives the credential from the write-only store and fails closed on any drift since approval, then runs sb user add|del <line> <payload> (the 233boy fork's atomic jq + sing-box check + rollback + restart path).
• users-admin.rotate: regenerates one protocol credential, one-time reveal, write-only read model preserved.
• User name rule (design-15 §5): u_<sha256(user_id|line_uuid)[:16]> — single join key for auth, auth_user routing, and per-user stats.
• Applied remove drops the server-side binding; managed lines are explicitly rejected with a pointer to the later slice.

Stacked on #13 (linemeta). Plugin manifest/UI wiring is the next slice.

Verification

• gofmt/go vet clean; go test ./... all ok (server pkg 20s)
• New tests: name rule shape/determinism, plan_add happy path (no secret in Plan, SHA-bound Action), rejections (unbound/disabled/unknown), apply script embeds reviewed credential + fail-closed on drift, rotate (uuid + password protocols, untouched credentials preserved), task-result ladder (failed task not applied; applied remove drops binding)

Refs LatticeNet/lattice#2, #13.