Implement NetKingdom identity shell for coulomb.social (CSOC-WP-0002)

Django scaffold aligned with the business delivery lane: tenant-keyed
Member model without passwords, identity app as sole OIDC/session
boundary, dev-claims login, authenticated /app/ shell, ADR-0001, and
tests. T01/T02/T05/T06 done; OIDC registration, real user-engine HTTP,
flex-auth, and packaging remain open.

coulomb_social/apps/members/admin.py

@@ -0,0 +1,39 @@
+from django.contrib import admin
+from django.contrib.auth.admin import UserAdmin as DjangoUserAdmin
+
+from .models import Member, User
+
+
+@admin.register(User)
+class UserAdmin(DjangoUserAdmin):
+    ordering = ("username",)
+    list_display = ("username", "email", "full_name", "is_staff", "is_active")
+    search_fields = ("username", "email", "full_name")
+    fieldsets = (
+        (None, {"fields": ("username",)}),
+        ("Profile", {"fields": ("full_name", "email")}),
+        ("Permissions", {"fields": ("is_active", "is_staff", "is_superuser", "groups", "user_permissions")}),
+    )
+    add_fieldsets = (
+        (
+            None,
+            {
+                "classes": ("wide",),
+                "fields": ("username", "is_staff", "is_superuser"),
+            },
+        ),
+    )
+
+
+@admin.register(Member)
+class MemberAdmin(admin.ModelAdmin):
+    list_display = (
+        "display_name",
+        "tenant_id",
+        "subject",
+        "user_engine_user_id",
+        "last_login_at",
+    )
+    search_fields = ("display_name", "email", "subject", "user_engine_user_id")
+    list_filter = ("tenant_id", "issuer")
+    readonly_fields = ("id", "created_at", "updated_at")