- Add internal/commands/user.go with full user CRUD implementation - Wire user subcommands in main.go dispatch - Mark user subcommands as Permitted: true - Support both padded-cell and manual mode for all user commands - user create uses account-manager token flow per plan