User management command (Admin+step-up); typed reason, expected version, audit event

One of five commands. Every one requires an admin session with an enrolled TOTP factor, a fresh admin-sensitive step-up grant, an Idempotency-Key, a typed reason and the expected_version read from GET /api/v1/admin/users/{id}. A stale version is 409 STALE_VERSION and writes nothing. There is no balance action here and there must never be one.

set_role and set_suspension are refused with 409 CONFLICT when they would leave the system with zero admins; the check locks the admin set inside the transaction, so two demotions racing cannot both succeed.

set_suspension blocks sign-in and every API key on the next request and stops new admissions for the account, but never cancels a running rental: it keeps metering and billing to funded expiry or stop. reset_mfa clears the enrolment and every session so the user must re-enrol; it never reveals or sets a secret.