Fix blank-screen on load + close 3 admin gaps (v0.1.0:79)

The web UI rendered a blank screen for every user. Root cause: the page
loaded @babel/standalone from unpkg with no version pin, so the CDN silently
served Babel 8.0.0. Babel 8 defaults @babel/preset-react to the automatic JSX
runtime, which prepends `import {jsx} from "react/jsx-runtime"` to the compiled
output. An ESM import is illegal in this classic (non-module) inline <script>,
so the browser rejected the whole bundle and React never mounted — hence the
blank screen. The prior "verified live" checks were server-up/curl, which can't
catch a browser-render failure.

- Pin @babel/standalone@7.29.7 (its preset-react defaults to the classic
  React.createElement runtime). Verified via headless render: app mounts, login
  screen renders, no console error. Follow-up: vendor + SRI-pin the CDN libs so
  a third party can't swap our front-end deps in production again.
- Close three server-side admin gaps surfaced by a permissions audit — endpoints
  that were UI-hidden from members but not API-enforced: GET /api/users,
  /api/email/status, /api/email/accounts now require_admin. Removed the now-dead
  non-admin mailbox-row filter. 21/21 backend tests green; py_compile clean.

backend/server.py

@@ -3914,6 +3914,11 @@ class CRMHandler(BaseHTTPRequestHandler):
         return self.send_json({"data": res})
 
     def handle_list_users(self, user):
+        # The full user directory (names, emails, roles) is admin-only — it is only
+        # consumed by the admin section of Settings. The nav already hides it from
+        # members; this enforces the same boundary server-side.
+        if not require_admin(user):
+            return self.send_error_json("Admin access required", 403)
         conn = get_db()
         users = rows_to_list(conn.execute(
             "SELECT id, username, email, full_name, role, is_active, created_at FROM users ORDER BY full_name"