feat(server): admin-initiated password reset

[dvcdsys]

What

Adds an admin-only password reset for existing users, plus an incidental
reconciliation of the OpenAPI codegen drift.

POST /api/v1/admin/users/{id}/reset-password — an admin sets a new temporary
password; the server flags the user must_change_password=1 and revokes the
target's existing sessions, so on next login the existing ChangePasswordPage
forces a new password (same as first login). Any admin may reset any user,
including another admin (a reset neither demotes nor disables anyone, so no
last-admin guard applies). Dashboard gets a "Reset password" action in the
users table.

Why

The only way to set a forced-change password was at user creation
(InviteUserDialog). There was no equivalent for an existing user who is
locked out or requests a reset. This mirrors the invite flow end-to-end and
reuses the existing first-login must_change_password machinery.

How

Two commits, each builds and tests green independently:

1. feat(server): admin-initiated password reset — the feature.

   • users.AdminResetPassword: sibling of UpdatePassword that sets the
     flag instead of clearing it.
   • Handler gates on mustBeAdmin, validates new_password (≥8), revokes
     sessions via Sessions.DeleteAllForUser, returns the updated user.
   • Dashboard: ResetPasswordDialog (cloned from InviteUserDialog) + the
     useResetUserPassword hook, wired into the users table.

2. chore(openapi): regenerate gen.go and route admin endpoints through the generated mux — the drift fix.

   • The committed openapi.gen.go had drifted from the pinned oapi-codegen
     (v2.7.0): it predated the embedding-provider endpoints, which were in the
     spec but hand-mounted in router.go as a stopgap. The feature commit
     added the reset route the same way.
   • This commit regenerates gen.go so HandlerFromMux owns all of them and
     removes the direct mounts (keeping both would double-register and panic
     chi). TestEmbeddingProvider/ResetUserPassword now take path params from
     the generated wrapper instead of chi.URLParam. The embedded
     /openapi.json blob now lists these endpoints (Swagger UI previously
     under-reported the API). make openapi-check is green again.
   • Incidental churn: regeneration also reorders some struct fields and adds
     .Valid() enum helpers the stale file lacked.

Backward-compatible / safe to ship: purely additive — no DB migration, no
changed/removed endpoints or behavior, no wire change in commit 2 (same routes,
methods, shapes). The dashboard ships inside the server binary, so there's no
version skew.

Pre-existing nit left untouched: router.go has a gofmt import-order quirk
(githubtokens/gitrepos) in a block this PR doesn't otherwise modify.

Type of change

• New feature
• Refactor (OpenAPI codegen reconciliation)

Checklist

• go build ./... + go test ./... pass
• make openapi-check green (gen.go in sync with doc/openapi.yaml)
• Dashboard npm run build / typecheck pass
• No secrets or API keys committed

🤖 Generated with Claude Code