feat(auth): force password reset for seeded default accounts

[jescalada]

Summary

• keep seeded local admin/admin and user/user bootstrap accounts available, including in production
• in production, mark seeded default local accounts with mustChangePassword=true at creation time
• add login hardening so if a default credential is successfully used in production (including legacy records), the account is flagged for forced password change
• add backend enforcement to block protected API usage with HTTP 428 until password is changed
• add POST /api/auth/change-password endpoint for authenticated local accounts
• expose mustChangePassword in auth/profile responses when applicable
• add frontend forced-reset UX on the login screen with an inline "change password now" flow
• route users with pending password change back to /login until reset is completed

Security behavior

This preserves development/test convenience while preventing long-term use of default credentials in production.

Testing

• npm test -- test/services/passport/local.test.ts test/services/routes/auth.test.ts test/testLogin.test.ts