Create user API

Scenario

POST /users accepts name, email, role, password, departmentId, and optional inviteMessage. Only admins can create users. Emails are unique case-insensitively. The endpoint returns 201 with id, email, role, status, createdAt, and inviteSent, publishes user.created, and sends an invitation email.