refactor: extract admin business logic to services

- Created TenantAdminService, FormAdminService, and UserAdminService
- Separated business operations (CRUD, audit logs, generation logic) from routes

services/user_admin_service.py

@@ -0,0 +1,41 @@
+from typing import Optional, List
+from models import db, User, UserRole
+from models import AuditLog
+import logging
+
+logger = logging.getLogger(__name__)
+
+class UserAdminService:
+    @staticmethod
+    def get_users():
+        return User.query.order_by(User.created_at.desc()).all()
+
+    @staticmethod
+    def update_user(target_user, email, name, role, admin_user):
+        target_user.email = email if email else target_user.email
+        target_user.name = name if name else target_user.name
+        if role in [r.value for r in UserRole]:
+            target_user.role = UserRole(role)
+
+        db.session.commit()
+
+        AuditLog.log_action(
+            action='update',
+            resource_type='user',
+            user=admin_user,
+            resource_id=target_user.id,
+            details={'email': target_user.email, 'role': target_user.role.value}
+        )
+
+    @staticmethod
+    def delete_user(target_user, admin_user):
+        db.session.delete(target_user)
+        db.session.commit()
+
+        AuditLog.log_action(
+            action='delete',
+            resource_type='user',
+            user=admin_user,
+            resource_id=target_user.id,
+            details={'email': target_user.email}
+        )