Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

Summary A user holding the delegated users:update permission can reset the global administrator's password and take over the admin account. UpdateUser sets the target user's PasswordHash from the request body for ANY target with no comparison of caller-vs-target privilege. Because role assignment...