feat(auth): enable password login on OAuth-only accounts, with disable control

Admins can now reset the password of an OAuth-only user, which creates
their credentials and enables password login; the new 'Disable password
login' row action removes those credentials again. Resetting a password
revokes all existing sessions.

- add users.password_login_enabled column (migration 0005)
- admin reset: set password, enable login, revoke sessions
- disable action: clear password, disable login (only on OAuth-linked rows)
- account endpoint: refuse password updates on OAuth-linked users
- e2e: wipe the test DB before the webServer starts (Playwright starts
  the server before globalSetup, so wiping there orphaned the DB file)
- row-actions strip test: five square actions, wrap on phone widths

docs/FEATURES.md

@@ -143,9 +143,10 @@
 - Admin dashboard to create, list, and delete users
 - Assign roles (admin / user)
 - Reset another user's password — Crumbs generates a 20-character password and shows it once in that user's row, with a copy button; it cannot be shown again
-  - Only for accounts that sign in with a password — OAuth/SSO accounts show why the reset is unavailable
+  - Works for any account other than your own, including OAuth-only — the reset deliberately enables password login and revokes all sessions
+  - **Disable password login** turns off password auth, clears the hash, and revokes sessions (not offered on your own row)
   - Your own password is changed from Settings > Profile, not here
-  - A reset does not sign the user out — revoke their sessions separately to force a logout
+  - Use **Revoke all sessions** separately if you need to force a logout without changing credentials
 - Revoke all sessions (force logout) for any user other than yourself
 
 ### PWA / Offline-First