feat(userMgr): add list users endpoint

Add new endpoint `/userMgr/list` to retrieve all users with superuser permission. Includes handler implementation, database query function, and API documentation update.

userAct.go

@@ -330,4 +330,41 @@ func RemoveUserHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	SendSuccessResponse(w, "User removed successfully", nil)
+}
+
+func ListUserHandler(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
+		postLog.Warning(fmt.Sprintf("[ListUserHandler] Invalid request method: %s", r.Method))
+		return
+	}
+
+	if !ValidateTimeStamp(r.Header) {
+		SendErrorResponse(w, http.StatusBadRequest, "Invalid or missing X-Timestamp in header")
+		return
+	}
+	userID, err := extractUserIDFromToken(r.Header.Get("X-Token"))
+	if err != nil {
+		SendErrorResponse(w, http.StatusUnauthorized, "Invalid or missing token")
+		postLog.Warning(fmt.Sprintf("[ListUserHandler] Invalid or missing token: %v", err))
+		return
+	}
+	user, err := GetUserByID(userID)
+	if err != nil {
+		SendErrorResponse(w, http.StatusInternalServerError, "Failed to get user info")
+		postLog.Error(fmt.Sprintf("[ListUserHandler] Failed to get user info for user [%d]%s: %v", userID, GetUsernameByID(userID), err))
+		return
+	}
+	if user.Type != "superuser" {
+		SendErrorResponse(w, http.StatusForbidden, "Permission denied")
+		postLog.Warning(fmt.Sprintf("[ListUserHandler] Permission denied: non-superuser token for user [%d]%s", userID, GetUsernameByID(userID)))
+		return
+	}
+	userList, err := DBQueryUsers()
+	if err != nil {
+		SendErrorResponse(w, http.StatusInternalServerError, "Failed to list users")
+		postLog.Error(fmt.Sprintf("[ListUserHandler] Failed to list users: %v", err))
+		return
+	}
+	SendSuccessResponse(w, "User list retrieved successfully", userList)
 }