fix(api): fail closed when status update cannot set user role

Return the UpdateUserRole error instead of silently continuing when an
admin approves a user with an explicit role_id.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/server/auth_handlers.go

@@ -294,7 +294,10 @@ func (s *Server) handleAdminUpdateStatus(w http.ResponseWriter, r *http.Request)
 	}
 
 	if req.RoleID != "" {
-		_, _ = s.authSvc.UpdateUserRole(r.Context(), targetID, req.RoleID, req.Position)
+		if _, roleErr := s.authSvc.UpdateUserRole(r.Context(), targetID, req.RoleID, req.Position); roleErr != nil {
+			http.Error(w, roleErr.Error(), http.StatusBadRequest)
+			return
+		}
 	}
 
 	updated, err := s.authSvc.UpdateUserStatus(r.Context(), targetID, req.Status)