Add redMCP user and membership tools

docs/redmineup_local_fork_changelog.md

@@ -48,6 +48,8 @@ environment. Before risky edits, archive the current plugin directories in
   - Added `searchIssues()` for issue-only Redmine text search.
   - Added `projects()`, `listProjects()`, and `project()` for Redmine's
     `/projects.json` APIs.
+  - Added `users()`, `listUsers()`, `user()`, and `projectMemberships()` for
+    Redmine's user and membership APIs.
   - Added a shared MCP dispatcher and transport-specific server wrappers.
   - Added `redMCP/bin/redmcp-server.php` for stdio MCP clients.
   - Added `redMCP/bin/redmcp-http-server.php` for bearer-token-protected
@@ -55,9 +57,11 @@ environment. Before risky edits, archive the current plugin directories in
   - Added PID/status/stop handling to the HTTP server.
   - Added optional full-argument JSONL debug logging via `--debug-log` or
     `MCP_DEBUG_LOG`.
+  - Added recursive credential redaction for MCP tool output and debug logs.
   - Added `redMCP/bin/generate-bearer-token.php`.
-  - Both transports expose Redmine project reads, filtering/search, issue CRUD,
-    Helpdesk-aware reads, and explicit Helpdesk response tools.
+  - Both transports expose Redmine project reads, users, project memberships,
+    filtering/search, issue CRUD, Helpdesk-aware reads, and explicit Helpdesk
+    response tools.
   - Registered all MCP helper commands as Composer `bin` entries.
 - LAN test result:
   - `php -l redMCP/app/RedmineClient.php` passed.
@@ -75,6 +79,12 @@ environment. Before risky edits, archive the current plugin directories in
   - HTTP PID helpers reported stopped/running states, rejected a duplicate
     start, stopped the live process, detected a stale PID file, and started
     with `--force`.
+  - Live Streamable HTTP tests passed for `redmine_list_users`,
+    `redmine_get_user`, and `redmine_list_project_memberships`.
+  - `redmine_get_user` redacted the returned Redmine `api_key` field.
+  - `redmine_list_project_memberships` returned direct and inherited
+    memberships for `customer-service`; `fud-helpdesk` returned a valid empty
+    membership list.
   - Debug logging wrote JSONL records with full project-tool arguments and did
     not include the bearer token, `Authorization`, or Redmine API key.
   - Token generation passed default, `--bytes 48`, and `--env-line` modes.