Start enforcing passwords on log in and sign up

[aapeliv]

Start of the end of magic login links.

• Enforce password on signup
• Jail users if they don't have a password, so they're forced to set one the next time they log in
• Jail bit in web frontend
• Password field on account form in web frontend

Backend checklist

• Formatted my code by running autoflake -r -i --remove-all-unused-imports src && isort . && black . in app/backend
• Added tests for any new code or added a regression test if fixing a bug
• All tests pass
• Run the backend locally and it works
• Added migrations if there are any database changes, rebased onto develop if necessary for linear migration history

Web frontend checklist

• Formatted my code with yarn format && yarn lint --fix
• There are no warnings from yarn lint
• There are no console warnings when running the app
• Added any new components to storybook
• Added tests where relevant
• All tests pass
• Clicked around my changes running locally and it works
• Checked Desktop, Mobile and Tablet screen sizes

[darrenvong]

Only some minor things, but frontend mostly looks fine

[darrenvong]

What does grpc do to sensitive fields?

(Obviously unrelated to the frontend review, mainly curious about this)

[aapeliv]

It's used in the backend to clear those fields before they're stored in to a debugging table:

couchers/app/backend/src/couchers/interceptors.py

Lines 185 to 195 in bfdfb49

	def _sanitized_bytes(self, proto):
	"""
	Remove fields marked sensitive and return serialized bytes
	"""
	if not proto:
	return None
	new_proto = deepcopy(proto)
	for name, descriptor in new_proto.DESCRIPTOR.fields_by_name.items():
	if descriptor.GetOptions().Extensions[annotations_pb2.sensitive]:
	new_proto.ClearField(name)
	return new_proto.SerializeToString()

[kalvdans]

Backend looks fine, two minor comments