Authenticated administrator escalation via unchecked isAdmin update

Missing authorization in Movary before 0.71.1 allows remote authenticated users to grant their own accounts administrator privileges. The PUT /settings/users/{userId} handler accepts an attacker-controlled isAdmin value during a permitted self-profile update and writes it directly to the user record without an administrator-only check. Any ordinary account with a valid web session can gain access to administrator-only settings and take over the application.