feat(auth): auto-create admin user profiles with highest tier and complimentary flag

- Add `is_complimentary` column to UserProfile model (migration 019)
- Update `_ensure_user_profile` to accept `is_admin` param; admins get
  highest subscription tier, is_complimentary=True, onboarding skipped
- Call `_ensure_user_profile` from all login paths (OAuth, local user, admin creds)
- Add `is_complimentary` to UserProfileUpsert schema, response helpers,
  list_users, get_user, upsert_user_profile in admin API
- Add complimentary toggle to admin users UI with gift badge in table
- Write 18 new tests covering complimentary plan and admin auto-creation
- Update SubscriptionTiers.md documentation

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

tests/test_auth_module.py

@@ -278,8 +278,10 @@ class TestAuthEndpoint:
                 mock_form_data = {"username": "admin", "password": "secret123"}
                 mock_request.form = AsyncMock(return_value=mock_form_data)
                 mock_request.session = {}
+                mock_db = MagicMock()
 
-                result = await auth(mock_request)
+                with patch("app.auth._ensure_user_profile"):
+                    result = await auth(mock_request, db=mock_db)
 
                 # Verify redirect to upload page
                 assert isinstance(result, RedirectResponse)
@@ -305,8 +307,9 @@ class TestAuthEndpoint:
                 mock_form_data = {"username": "admin", "password": "wrong_password"}
                 mock_request.form = AsyncMock(return_value=mock_form_data)
                 mock_request.session = {}
+                mock_db = MagicMock()
 
-                result = await auth(mock_request)
+                result = await auth(mock_request, db=mock_db)
 
                 # Verify redirect to login with error
                 assert isinstance(result, RedirectResponse)
@@ -327,8 +330,10 @@ class TestAuthEndpoint:
                 mock_form_data = {"username": "admin", "password": "secret123"}
                 mock_request.form = AsyncMock(return_value=mock_form_data)
                 mock_request.session = {"redirect_after_login": "/protected/page"}
+                mock_db = MagicMock()
 
-                result = await auth(mock_request)
+                with patch("app.auth._ensure_user_profile"):
+                    result = await auth(mock_request, db=mock_db)
 
                 # Verify redirect to saved URL
                 assert isinstance(result, RedirectResponse)