Improvements to the "User roles" report

The "User roles" report now includes office-bearers roles (elders, deacons, and pastors) alongside administrators, statisticians, and the other application roles — these are all forms of elevated access, so it makes sense to see them in one place.

We've also added a new "Two-factor auth" column that shows whether each user has 2FA enabled, either because they've turned it on themselves or because it's required by their role.