CC2 R3 frontend: login.html + admin_users.html (M1+M2+M10 UI)

- static/login.html: dark Palantir-style login with PGŽ branding,
  Prijava se / Zaboravljena lozinka, demo account quick-fills,
  GDPR cookie banner, autostore tokens (local/session)
- static/admin_users.html: full user-management admin panel:
  - Collapsible left sidebar (Pregled, Korisnici, Tenanti, Audit log,
    Sigurnost, GDPR, links to ERP/CRM)
  - Users table with filters (q, tenant, role, status, limit)
  - + Dodaj korisnika modal (CRUD via /api/admin/users/*)
  - Suspend / unsuspend / reset-password / delete actions
  - Audit log viewer + Security KPIs + GDPR queue
  - Self-service: change pwd, export data (Art. 20), erasure request (Art. 17)
- pgz_sport_api.py: /login and /admin/users URL routes
- auth/seed_demo.py: added tajnik@atletski.pgz.hr/Atl2026!,
  admin@ak-kvarner.hr/Kvarner2026! demo users

5/5 live tests pass: login JWT, /me, /admin/users, /gdpr/consent, /gdpr/export

Note: existing admin.html (CC4 ERP/OCR work) preserved intact;
admin_users.html is dedicated user-mgmt page linked from sidebar.

pgz_sport_api.py

@@ -1449,6 +1449,32 @@ def serve_admin():
         return FileResponse(p)
     return {"error": "admin.html not found"}
 
+@app.get("/erp")
+@app.get("/erp/")
+@app.get("/app/erp")
+@app.get("/app/erp/")
+def serve_erp():
+    p = HTML_DIR / "erp.html"
+    if p.exists():
+        return FileResponse(p)
+    return {"error": "erp.html not found"}
+
+@app.get("/login")
+@app.get("/login/")
+def serve_login():
+    p = HTML_DIR / "login.html"
+    if p.exists():
+        return FileResponse(p)
+    return {"error": "login.html not found"}
+
+@app.get("/admin/users")
+@app.get("/admin/users/")
+def serve_admin_users():
+    p = HTML_DIR / "admin_users.html"
+    if p.exists():
+        return FileResponse(p)
+    return {"error": "admin_users.html not found"}
+
 
 @app.get("/api/sportski-objekti")
 def list_sportski_objekti(q=None,tip=None,grad=None):