fix(auth): enforce the forced password change on the server

[TartanLeGrand]

What

A user flagged mustChangePassword (the bootstrap admin, users created or reset by an administrator) could call every API endpoint with their session: only the web UI redirected them to the password page. The server now enforces it.

• Principal carries MustChangePassword, set from the user record when a session is resolved. API keys, anonymous callers and OpenID Connect users are never flagged.
• authz.CheckPermission refuses a flagged principal for every permission except public ones: HTTP 403 {"error":"password change required"}, gRPC PermissionDenied. It covers every RPC (through Authorize) and every hand-written route wrapped by RequireHTTP (links, Homer).
• Still reachable while flagged: GET /auth/me, GET /auth/config, login, logout and POST /auth/password (not wrapped by authz). Web assets, /config.js and the API docs serve no data and are unchanged.
• An invalid credential still answers 401 first.
• Metric: tracker_auth_requests_total{result="password_change_required"}.

Behaviour around the change

• Changing the password clears the flag, bumps the session version and issues a new cookie; the old cookie answers 401. The web change-password page (feat(web): login page, auth context and admin pages #201) already uses the response cookie, so its flow is unchanged.
• An administrator reset signs the user's existing sessions out (session version bump); the restriction applies from their next login.

Checks

• go test (serial, MongoDB 7): green. New tests: authz unit tests, resolver test, an end-to-end flow through the real mux (flagged admin gets 403 on data and admin endpoints, 200 on /auth/me, changes the password, new cookie works, old cookie 401, logout works while flagged), team API keys unaffected by their creator's flag.
• Mutation check: with the rule disabled, four tests fail.
• go vet, golangci-lint (0 issues), gosec (0 issues).

Existing service tests that called admin RPCs as the (flagged) bootstrap admin now clear the flag on their test principal only; production behaviour is not relaxed.

Refs #196