Require bootstrap admin password change on first login

[matteius]

Summary

• flag only newly created fallback admin/admin accounts for an immediate password change
• restrict password-authenticated bootstrap sessions to auth verification and changing their own password
• block every application entry point until the password is replaced, while preserving password-first MFA ordering

Compatibility and security

• existing installations remain unflagged
• a configured [web] password skips the forced-change flow
• scoped and legacy API tokens continue to work
• demo mode remains read-only and unaffected
• successful replacement clears the flag atomically, invalidates sessions, and clears auth cookies

Validation

• full C build
• 76 applicable C tests
• focused auth and route-gating tests
• 122 frontend tests
• production Vite build

Closes #493