Console: single-form user approval (member status + role + orgs + Hub groups)

[bsatoriu]

Problem

Approving a new MAAP user is currently two discrete steps in two different
admin tools:

1. MAAP API member record — set status (suspended → active) and role via
   the Console Users admin (or WP admin).
2. Keycloak — assign JupyterHub group(s) (JupyterHub MAAP User,
   Basic User, GPU User, Admin) in the Keycloak admin console so the user
   can actually launch a workspace.

Missing either step leaves the user half-provisioned (active member with no hub
access, or hub roles on a suspended account). With CAS decommissioned and
member auto-create now happening on first Keycloak login, the Console is the
natural single control point.

Proposal

One "Review User" modal in the Console Users admin combining both systems:

Field	Backed by	Notes
Status	MAAP API (POST /members/<user>/status)	activation email fires on activate (Hub owns new-user emails)
Role	MAAP API (PUT /members/<user>, role_id)	Guest / Member / Admin
Organizations	MAAP API (organizations membership)	search + multi-select
Hub Groups	Keycloak admin API (group membership)	the four JupyterHub groups; disabled while status = suspended

Open questions

1. Suspend behavior: should suspending a user clear their hub groups, or
   just disable editing (current mockup keeps them but inert)? Keycloak groups
   still grant hub login while assigned — suspension probably must revoke.
2. Audit trail: we can add an audit log in the MAAP API (viewable in the Console) to record who approved whom.
3. Role ↔ group coupling: should choosing role Admin auto-suggest the
   JupyterHub MAAP Admin group (and vice versa), or stay fully independent?