Add password confirmation and an admin users/privkey panel

Registration now requires the password twice, rejected client-side on
mismatch before hitting the API. The admin page gets a Utenti card:
loads the user list (id, username, address, balance in PLM) and a
per-row "Mostra" button that reveals the private key after an explicit
confirm() — click again to hide it. A persistent warning banner notes
that every reveal is audit-logged.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/static/index.html

@@ -185,6 +185,8 @@
     <input id="reg-username" autocomplete="username">
     <label for="reg-password">Password</label>
     <input id="reg-password" type="password" autocomplete="new-password">
+    <label for="reg-password-confirm">Conferma password</label>
+    <input id="reg-password-confirm" type="password" autocomplete="new-password">
     <button onclick="register()" id="register-btn">Crea account</button>
   </div>
 </section>
@@ -391,6 +393,11 @@ async function register() {
   const btn = document.getElementById('register-btn');
   const u = document.getElementById('reg-username').value;
   const p = document.getElementById('reg-password').value;
+  const pConfirm = document.getElementById('reg-password-confirm').value;
+  if (p !== pConfirm) {
+    toast('Le password non coincidono.', 'error');
+    return;
+  }
   await withLoading(btn, 'Creazione…', async () => {
     try {
       const data = await call('POST', '/auth/register', { username: u, password: p });