T10.4: remove the local password path entirely

Real deletion (D15's 'full replacement'), not a toggle. Okta is now the only
credential this app accepts anywhere.

Backend:
- server/models.py: drop User.password_hash.
- server/alembic/versions/1d60a608bb51_...: matching migration (op.drop_column,
  same plain-drop precedent as project_role/locked_until/etc.; downgrade re-adds
  it with server_default='').
- server/auth.py: remove hash_password/verify_password/password_problem/
  MIN_PASSWORD_LEN/_COMMON_PASSWORDS, create_reset_token/decode_reset_token/
  RESET_MINUTES, the bcrypt import. Roles/tokens/cookies/get_current_user
  untouched.
- server/app.py: remove login(), the whole self-service reset-password block
  (forgot-password/reset-available/reset-password), and change_password()
  (POST /api/auth/password). Rework create_user() to drop the password field
  (with a docstring note: the username must exactly match the eventual Okta
  identity claim, or a later sign-in provisions a second account instead of
  matching this one). Remove admin_reset_password() outright - nothing left to
  reset. Fixes a bug this task's own predecessor left behind: okta_callback()'s
  JIT provisioning (T10.3) was still setting password_hash="", which would have
  raised TypeError the moment the column was actually dropped.

Admin bootstrap (D16): server/manage_users.py moves from creating accounts
(create/create-admin/reset-password, all password-based) to a single 'promote
<username> --role <role>' command that changes the role on a row Okta's JIT
provisioning already created - the documented path for naming the first admin.
list/disable/enable unchanged.

Frontend: html/users.js drops the password field and validation from
createUser(), removes resetPw() and its button (nothing left to reset).
html/users.html drops the #nu-password input, adds a tooltip on username
explaining the exact-match-to-Okta requirement. html/auth-guard.js removes the
wpChangePassword dialog; html/wp-sidenav.js removes the 'Password' menu item
that opened it.

Tests: tests/browser_check.py and tests/launcher_check.py stop hashing a
password to seed fixture rows (and the --keep-server hint now prints a
ready-to-use cookie-setting snippet instead of a dead username/password).
tests/pipeline_check.py and tests/token_check.py drop an unused PW import.
tests/console_dialogs_check.py: the admin password-reset dialog it drove no
longer exists, so that scenario is removed - the prompt-with-validate() UI
pattern it exercised is still covered via creator_dialogs_check.py's
wp-creation-app.js call sites, noted in this file's docstring so the coverage
move isn't silent. tests/url_state_check.py: the "next= survives a real sign-in
via login" scenario is explicitly marked SKIPPED (not deleted, not faked) -
that promise is specific to the login FORM this task removed and can't be
honestly re-proven until T10.5 rebuilds it as an Okta redirect; a minted-token
cookie now stands in as setup only, so scenarios 3-6 in that file still get a
signed-in page to run against.

server/smoketest.py and server/seed_demo.py: switched from POST /api/auth/login
to minting a session the same way okta_callback() does (auth.create_token(),
seeded into the cookie jar) rather than waiting on T10.7. This is a real
operational change, documented in both files' own AUTHENTICATION sections: they
now need to run where AUTH_SECRET_KEY and the database match the target
server's (inside the api container, or local dev) - they can no longer sign in
to an arbitrary remote URL from an unrelated workstation, because Okta requires
a real browser and these are stdlib scripts. The account must already exist;
neither script creates or promotes one.

server/requirements.txt: bcrypt dropped, nothing imports it anymore.

Verified: full Alembic chain (baseline through this migration) upgrades and
downgrades cleanly against a throwaway SQLite DB. okta_callback() JIT
provisioning re-tested against the post-migration schema (would have thrown
before the password_hash="" fix above). create_user() verified via a live HTTP
call with no password field. manage_users.py promote verified end to end
(seed a JIT-shaped row at project_user, promote to admin, list). smoketest.py
and seed_demo.py both run to completion against a live uvicorn instance using
the new minted-session path - 25/25 checks, including logout actually
invalidating the session (proving the cookie-jar seeding didn't just fake the
sign-in, it preserved the real expiry mechanics).

wave-10.md T10.4 / D15 / D16

html/auth-guard.js

@@ -60,62 +60,10 @@
       .then(function () { window.location.replace('login.html'); });
   };
 
-  // Change-password dialog (uses POST /api/auth/password, which requires the
-  // current password). Available from the top-right pill on any page.
-  window.wpChangePassword = function () {
-    if (document.getElementById('wp-pw-modal')) return;
-    var ov = document.createElement('div');
-    ov.id = 'wp-pw-modal';
-    ov.style.cssText = 'position:fixed;inset:0;background:rgba(20,30,50,.5);display:flex;align-items:center;' +
-      'justify-content:center;z-index:10002;padding:20px;font:14px/1.4 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif;';
-    var inp = 'width:100%;padding:9px 10px;margin-bottom:12px;border:1px solid var(--cds-border-strong);border-radius:4px;font-size:14px;';
-    var lbl = 'display:block;font-size:12px;color:var(--cds-text-secondary);margin-bottom:4px;';
-    ov.innerHTML =
-      '<div style="background:var(--cds-layer);color:var(--cds-text-primary);border-radius:10px;max-width:380px;width:100%;box-shadow:0 12px 40px rgba(20,30,50,.3);overflow:hidden;">' +
-        '<div style="padding:14px 18px;border-bottom:1px solid var(--cds-border-subtle);font-weight:700;">Change password</div>' +
-        '<div style="padding:16px 18px;">' +
-          '<div id="wp-pw-msg" style="display:none;font-size:12.5px;padding:8px 10px;border-radius:6px;margin-bottom:12px;"></div>' +
-          '<label style="' + lbl + '">Current password</label>' +
-          '<input id="wp-pw-cur" type="password" autocomplete="current-password" style="' + inp + '">' +
-          '<label style="' + lbl + '">New password (at least 12 characters)</label>' +
-          '<input id="wp-pw-new" type="password" autocomplete="new-password" style="' + inp + '">' +
-          '<label style="' + lbl + '">Confirm new password</label>' +
-          '<input id="wp-pw-new2" type="password" autocomplete="new-password" style="' + inp + 'margin-bottom:0;">' +
-        '</div>' +
-        '<div style="padding:12px 18px;border-top:1px solid var(--cds-border-subtle);display:flex;gap:8px;justify-content:flex-end;">' +
-          '<button type="button" id="wp-pw-cancel" style="padding:8px 14px;border:1px solid var(--cds-border-strong);background:var(--cds-layer);border-radius:6px;cursor:pointer;font-weight:600;">Cancel</button>' +
-          '<button type="button" id="wp-pw-save" style="padding:8px 14px;border:none;background:var(--cds-interactive-01);color:var(--cds-text-on-color);border-radius:6px;cursor:pointer;font-weight:600;">Update password</button>' +
-        '</div>' +
-      '</div>';
-    function close() { var m = document.getElementById('wp-pw-modal'); if (m) m.remove(); }
-    function msg(text, ok) {
-      var el = document.getElementById('wp-pw-msg');
-      el.style.display = 'block'; el.textContent = text;
-      el.style.background = ok ? 'var(--wp-status-success-bg)' : 'var(--wp-status-error-bg)'; el.style.color = ok ? 'var(--wp-status-success-text)' : 'var(--cds-support-error)';
-    }
-    ov.addEventListener('click', function (e) { if (e.target === ov) close(); });
-    document.body.appendChild(ov);
-    document.getElementById('wp-pw-cancel').onclick = close;
-    document.getElementById('wp-pw-cur').focus();
-    document.getElementById('wp-pw-save').onclick = function () {
-      var cur = document.getElementById('wp-pw-cur').value;
-      var n1 = document.getElementById('wp-pw-new').value;
-      var n2 = document.getElementById('wp-pw-new2').value;
-      if (!cur || !n1) { msg('Please fill in every field.', false); return; }
-      if (n1.length < 12) { msg('New password must be at least 12 characters.', false); return; }
-      if (n1 !== n2) { msg('New passwords do not match.', false); return; }
-      fetch('/api/auth/password', {
-        method: 'POST', headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ current_password: cur, new_password: n1 })
-      })
-        .then(function (r) { return r.json().catch(function () { return null; }).then(function (j) { return { ok: r.ok, status: r.status, j: j }; }); })
-        .then(function (res) {
-          if (res.ok) { msg('Password updated.', true); setTimeout(close, 1200); }
-          else { msg((res.j && res.j.detail) || ('Could not update (HTTP ' + res.status + ').'), false); }
-        })
-        .catch(function () { msg('Could not reach the server.', false); });
-    };
-  };
+  // window.wpChangePassword used to open a change-password dialog here. Removed in
+  // T10.4 (D15/D16): there is no local password to change anymore — identity is
+  // Okta's job. The "Password" item that called this is gone from wp-sidenav.js
+  // too.
 
   // ── permissions helpers ────────────────────────────────────────────────────
   // The server enforces all of this; these are for hiding controls the signed-in
@@ -171,7 +119,8 @@
   // Admin, Users and Sign out from the navigation drawer, and being one unbreakable
   // 412px run with an inline white-space:nowrap, it was what clipped the bar at 390px
   // and cut "Sign out" in half — F2. wp-sidenav.js now carries all of it, including
-  // the two items that were only here: Language & time, and Password.
+  // the item that was only here: Language & time. (Password was the other one; T10.4
+  // removed it along with the rest of local auth — D15/D16.)
   //
   // Nothing replaces it. Every signed-in page mounts the drawer, so there is no page
   // left that would need a floating fallback pill.