feat(front): câbler PATCH refus utilisateur depuis wizards validation (#110)

- UserService.refuseUser → /users/:id/refuser
- AM + famille : envoi motifs, onSuccess + refresh liste
- Famille : refus séquentiel pour chaque parent en_attente
- ValidationRefusForm : état isSubmitting (UX)

Co-authored-by: Cursor <cursoragent@cursor.com>

frontend/lib/services/user_service.dart

@@ -215,6 +215,30 @@ class UserService {
     return AppUser.fromJson(Map<String, dynamic>.from(data is Map ? data : {}));
   }
 
+  /// Refuser un compte en attente (AM ou parent). PATCH /users/:id/refuser. Ticket #110.
+  static Future<AppUser> refuseUser(String userId, {String? comment}) async {
+    final response = await http.patch(
+      Uri.parse('${ApiConfig.baseUrl}${ApiConfig.users}/$userId/refuser'),
+      headers: await _headers(),
+      body: jsonEncode(
+        comment != null && comment.trim().isNotEmpty
+            ? {'comment': comment.trim()}
+            : {},
+      ),
+    );
+    if (response.statusCode != 200) {
+      try {
+        final err = jsonDecode(response.body);
+        throw Exception(_errMessage(err is Map ? err['message'] : err));
+      } catch (e) {
+        if (e is Exception) rethrow;
+        throw Exception('Erreur refus (${response.statusCode})');
+      }
+    }
+    final data = jsonDecode(response.body);
+    return AppUser.fromJson(Map<String, dynamic>.from(data is Map ? data : {}));
+  }
+
   /// Valider tout le dossier famille. POST /parents/:parentId/valider-dossier. Ticket #108.
   static Future<List<AppUser>> validerDossierFamille(String parentId, {String? comment}) async {
     final response = await http.post(