README: users/roles/profile section

Documents the two roles (user vs admin), the admin-only /users page with its self-protection guards, the open-viewing/admin-mutation split on saddles and capabilities, and /profile for changing one's own password (including rotating the seeded admin password).

README.md

@@ -197,6 +197,30 @@ transitions) and `POST /api/saddle/chunks` (raw PTY batches) — every
 `/api/saddle/*` call is authenticated by the per-saddle bearer token
 (removing the saddle revokes it).
 
+## Users, roles and your profile
+
+Two roles decide what a logged-in user can do (the account model is
+Spry's; this app surfaces it):
+
+- **user** — manages projects, tasks, goals and rules.
+- **admin** — additionally manages **users** (`/users`), **saddles**
+  (register/remove, git identity, capability tags) and the
+  **capability catalogue**. Viewing `/saddles` stays open to every
+  logged-in user; the mutation controls are hidden and server-refused
+  for non-admins.
+
+`/users` (admin-only) lists accounts newest-first with a role badge
+and enabled state: create users, edit profile fields, reset passwords,
+enable/disable, grant/revoke admin, delete. Guards keep you from
+locking yourself out: you cannot delete or disable your own account,
+cannot revoke your own admin permission, and the last enabled admin
+cannot be removed.
+
+Every logged-in user has **`/profile`** (linked beside the logout
+button in the nav corner): shows your account details and changes your
+own password — current, new, confirm. Change the seeded admin's
+`change-me` password there before exposing the app.
+
 ## Monitoring agent progress
 
 - **`/tasks`** — live queue: status chips (`draft → queued → assigned →