feat(cli): add tiger user:password — console password reset

[WebTigers]

Why

The console had no password reset. That leaves two real dead ends:

• An install that can't send email. A fresh or dev box with no MTA silently drops the reset mail — and the web flow deliberately gives no hint (no account enumeration), so it looks like it worked and nothing ever arrives.
• A lone locked-out admin with no second account to rescue them.

Found this the hard way on dev-com: mail.transport defaulting to PHP mail(), php sendmail_path pointing at /usr/sbin/sendmail, and that binary not existing.

What

vendor/bin/tiger user:password [--user=<email|username>] [--password=] [--force]

• Resolves the target with Tiger_Model_User::findByIdentifier, so --user= accepts an email or a username.
• Writes through Tiger_Model_UserCredential::setPassword — the same model the web reset uses.
• Enforces the install's live Tiger_Policy_Password (length / complexity / reuse).
• Prompts for anything not passed as a flag; --password= keeps it non-interactive.

This is a different door, not a shortcut. Going through the same model means the pepper, the history archive, and reuse-prevention all still apply, and the old password stops working. --force overrides the policy only, never the hashing — so a locked-out admin can always get back in, and a forced password is still peppered and bcrypted rather than stored raw.

Tests

bin/tiger is a procedural script, so the tests exercise the sequence the command performs (resolve → policy → setPassword) — which is where the guarantees actually live:

• identifier resolution by both email and username, and null for an unknown one
• the new password authenticates and the old one no longer does
• a reset replaces the credential row (idempotent — never accumulates)
• the outgoing hash is archived, so reuse-prevention still catches the old password
• a --forced password is never stored in plaintext and still verifies normally

Full suite: 2048 tests, 0 failures, 15 deprecations — the existing baseline (2043 + 5 new).