Fix role change silently failing via @bind

The role <select> used a manual value=/@onchange pattern that parsed
e.Value and returned silently when the parse failed, so changing a role
did nothing and showed no message. Switch to @bind + @bind:after so the
framework handles the enum conversion, and log/verify the persisted role
in UpdateRoleAsync (now returns the previous role) for diagnosis.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Components/Pages/Admin/UserManagement.razor

@@ -86,12 +86,11 @@ else
                         </td>
                         <td style="padding:8px">
                             <select class="form-input" style="width:130px"
-                                    value="@user.Role"
-                                    @onchange="e => OnRoleChange(user, e)"
+                                    @bind="user.Role" @bind:after="() => PersistRoleAsync(user)"
                                     disabled="@(user.Email == UserContext.Email)">
                                 @foreach (var role in Enum.GetValues<UserRole>())
                                 {
-                                    <option value="@role" selected="@(user.Role == role)">@role</option>
+                                    <option value="@role">@role</option>
                                 }
                             </select>
                         </td>
@@ -193,16 +192,14 @@ else
         }
     }
 
-    private async Task OnRoleChange(AppUser user, ChangeEventArgs e)
+    // Bound via @bind:after, so user.Role already holds the newly-selected value when this runs.
+    private async Task PersistRoleAsync(AppUser user)
     {
-        if (!Enum.TryParse<UserRole>(e.Value?.ToString(), out var newRole)) return;
         try
         {
-            var oldRole = user.Role;
-            await UserService.UpdateRoleAsync(user.Id, newRole);
-            user.Role = newRole;
+            var oldRole = await UserService.UpdateRoleAsync(user.Id, user.Role);
             await Audit.LogAsync("RoleChanged", "", Array.Empty<string>(),
-                $"Changed role for {user.Email} ({user.DisplayName}) from {oldRole} to {newRole}.");
+                $"Changed role for {user.Email} ({user.DisplayName}) from {oldRole} to {user.Role}.");
             _message  = string.Format(T["usermgmt.msg.roleupdated"], user.DisplayName);
             _isError  = false;
         }