Fix role change silently failing via @bind

The role <select> used a manual value=/@onchange pattern that parsed
e.Value and returned silently when the parse failed, so changing a role
did nothing and showed no message. Switch to @bind + @bind:after so the
framework handles the enum conversion, and log/verify the persisted role
in UpdateRoleAsync (now returns the previous role) for diagnosis.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Services/Auth/IUserService.cs

@@ -11,7 +11,9 @@ public interface IUserService
 
     Task<AppUser?> GetByEmailAsync(string email);
     Task<IReadOnlyList<AppUser>> GetAllAsync();
-    Task UpdateRoleAsync(string userId, UserRole role);
+    /// <summary>Persist a new role for the user. Returns the previous role (read from the store).</summary>
+    /// <exception cref="KeyNotFoundException">No user matches <paramref name="userId"/>.</exception>
+    Task<UserRole> UpdateRoleAsync(string userId, UserRole role);
     Task DeleteAsync(string userId);
 
     /// <summary>Create a local password-based account. First user ever becomes Admin.</summary>