feat: welcome desk auth and operator password reset

First visit lands on /welcome instead of burying signup in Settings.
Add a host CLI to reset passwords without a session, plus Settings
change-password. Refresh as-built design docs and the Unraid operator guide.

app/server/src/trpc/router.ts

@@ -129,6 +129,16 @@ const authRouter = router({
     ctx.resHeaders.append('Set-Cookie', clearCookie());
     return { ok: true };
   }),
+  changePassword: protectedProcedure
+    .input(z.object({ current: z.string(), next: z.string().min(8) }))
+    .mutation(({ ctx, input }) => {
+      const row = ctx.db.prepare('SELECT pw_hash FROM users WHERE id=?').get(ctx.userId) as { pw_hash: string } | undefined;
+      if (!row || row.pw_hash === 'oauth' || !verifyPassword(input.current, row.pw_hash)) {
+        throw new TRPCError({ code: 'UNAUTHORIZED', message: 'Current password is wrong.' });
+      }
+      ctx.db.prepare('UPDATE users SET pw_hash=? WHERE id=?').run(hashPassword(input.next), ctx.userId);
+      return { ok: true };
+    }),
   me: publicProcedure.query(({ ctx }) => {
     if (!ctx.userId) return null;
     const u = ctx.db.prepare(