Two related fixes to SSO-provisioned account handling, plus documentation corrections for the resulting behavior.

  - Gate AuthService.reset_user_password on the same `provider` check
    change_password already uses, so an SSO-provisioned account can no longer
    be given a live local password hash via admin password reset. Hide the
    "Change Password" (My Account) and "Reset Password" (Users tab) controls
    but always failed or no-op'd server-side.

  - Admin panel SSO login was previously all-or-nothing: only identities on
    the admin_users allowlist could log in at all, and every allowlisted
    login force-reset the role back to admin, silently overwriting any
    manual role edit made via the Users tab. Non-allowlisted SSO identities
    now log in successfully as long as they hold any admin-panel role
    (operator/auditor/analyst/user-manager) assigned locally, and that role
    now persists across logins instead of requiring allowlisting for any
    admin-panel access. Allowlisted identities still always resolve to full
    admin, by design, on every login.

  - Correct docs/authentication.md and docs/rbac-architecture.md, which
    contradicted each other on this exact behavior, and add a troubleshooting
    note for the "role keeps reverting to admin" case (remove the identity
    from admin_users to make a demotion stick).