Land PLUTO-641 orphaned app-side refactor (admin fn_* calls)

Land staged postgres-boundary refactor sitting uncommitted in admin-actions.ts/administrar-actions.ts (orphaned WIP from PLUTO-641): moves admin read paths + bulkImportUsers off inline SQL onto fn_getAdminUserDetail/fn_getStudentsWithoutAssignment/fn_bulkImportUsers (+2 more, 5 total). ~133 lines, unattributed, app-side only -- all 5 backing fns confirmed live via db-pluto-cc readiness read, no schema gap. Class-A: bulkImportUsers + fn_getAdminUserDetail are admin-permission-adjacent -- audit design-ping before diff review, full diff review, Class-A PTD required, not a same-night push. On land, PLUTO-640's remaining sites target fn_* calls per Database-Shaped Work directive instead of inline queries. DECISION (pm-pluto-cc, 2026-07-31): LAND, not discard -- fns deployed+unused is a state worth ending; discarding wastes done DB work and forces re-derivation later.