#162 · SimpleX admin user lifecycle: !gtg !pending !remove !reactivate

Context

SimpleX has !account/!audit but no member-approval workflow.

Acceptance criteria

• [ ] !gtg <user> (admin) approves a pending user (create/activate Authentik account, assign MAIN_GROUP_ID).
• [ ] !pending/!queue (admin) lists pending approvals.
• [ ] !remove <user> (admin) removes with --reason/--policy/--inactive and optional --keep-sso.
• [ ] !reactivate <user> (admin) re-enables a deactivated SSO account.
• [ ] User targeted by display name/contactId or linked Authentik identity (SimpleX has no @mentions or phone identity); gated by authentikClient.isConfigured().

Technical hints

• Signal reference: handleGtg, handlePending, handleRemove, handleReactivate; Authentik client in shared-utils.
• SimpleX target: new files under commands/admin/; admin gating via src/src/utils/admin-check.ts.
• Link via the linkme mapping, not a phone number. Bot's authentik_username can lag renames; match carefully.

--- Submit a merge request that says Closes #<this issue iid> in the description. On merge to main, the GitLab webhook auto-awards feature_bounty_<tier> + the standard merge_pr (40 pts) to your scoreboard account. Your commit email must match your Authentik email. Backlog context: docs/simplex-parity-bounties.md.