T10.3 D13 - drop users.password_hash and every path that touched it

The irreversible one. The suite no longer stores a credential of any kind.

Removed from app.py: /api/auth/forgot-password, /api/auth/reset-password,
/api/auth/reset-available, /api/auth/password, /api/auth/users/{id}/password,
the four password-bearing input models, the reset throttle and mail body, and
the password arguments to create_user. Removed from auth.py: hash_password,
verify_password, password_problem, MIN_PASSWORD_LEN, _COMMON_PASSWORDS,
create_reset_token, decode_reset_token, RESET_MINUTES, and the bcrypt import.
Removed from notify.py: the password_reset_enabled feature flag. Removed from
manage_users.py: the password prompt and the reset-password command.

token_version STAYS. Password changes no longer exist, but a role change or a
deactivation still has to invalidate sessions that are already issued.

/api/auth/users/{id}/role stays, which is D13 criterion 4 - granting admin to
an existing account must keep working, and it does.

Migration b7e4f1a20c93 uses batch_alter_table because SQLite has no DROP COLUMN
before 3.35 and local dev runs on SQLite while production runs on Postgres.
downgrade() recreates the column NULLABLE rather than NOT NULL as the baseline
declared it: there are no hashes to put back, and a NOT NULL column with no
server default refuses to add itself to a table with rows. The docstring says
plainly that the downgrade does not restore the old login - it exists so the
revision is well-formed, not because stepping back is a recovery path.

Verified:

  upgrade head from empty      -> password_hash absent from users
  downgrade -1                 -> column back, nullable (notnull=0)
  upgrade head again           -> absent again
  remaining /api/auth routes   -> no password or reset route left
  create-admin                 -> works with no password prompt
  grep for the removed symbols -> nothing outside the migration and one
                                  docstring that names the dropped column

NOT verified, and it is a done-when box left open rather than ticked: the
migration has only been round-tripped on SQLite. No Postgres is available here.
batch_alter_table takes the direct ALTER path on Postgres, which is the simpler
of the two, but "simpler" is not "tested".

notify.send_now is now orphaned - its only caller was forgot_password. Logged as
BL-026 rather than deleted in passing, because an immediate unqueued send is a
reasonable primitive to keep and that decision does not belong in an auth task.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

server/models.py

@@ -142,8 +142,14 @@ class WorkPackage(Base):
 
 
 class User(Base):
-    """A login account. Passwords are never stored in the clear — only a bcrypt
-    hash (see server/auth.py). `username` is what people sign in with.
+    """A login account. NO PASSWORD IS STORED — D13 moved authentication to an
+    LDAPS bind against the domain (see server/ldap_auth.py), and the
+    `password_hash` column was dropped. `username` is the sAMAccountName people
+    sign in with; an account is created on first successful sign-in if it does not
+    already exist.
+
+    `is_active` is LOCAL and overrides the directory: clearing it revokes access to
+    this app without touching the domain account.
 
     Two independent notions of "role", deliberately separate:
       • role          the PERMISSIONS role — what the account may do in the app.
@@ -159,7 +165,6 @@ class User(Base):
     username: Mapped[str] = mapped_column(String(120), unique=True, index=True)
     email: Mapped[str] = mapped_column(String(200), default="")
     full_name: Mapped[str] = mapped_column(String(200), default="")
-    password_hash: Mapped[str] = mapped_column(String(200), default="")
     role: Mapped[str] = mapped_column(String(20), default="project_user")  # permissions role
     # Job function on the project — free text, offered from a suggested list.
     project_role: Mapped[str] = mapped_column(String(120), default="")
@@ -182,12 +187,14 @@ class User(Base):
     # Online-guessing throttle (see login()): consecutive failures + a lockout window.
     failed_attempts: Mapped[int] = mapped_column(Integer, default=0)
     locked_until: Mapped[Optional[datetime]] = mapped_column(DateTime(timezone=True), nullable=True)
-    # Bumped to invalidate all existing sessions for this user (e.g. on a password
-    # change). The value is embedded in the JWT and re-checked on every request.
+    # Bumped to invalidate all existing sessions for this user. Password changes no
+    # longer exist (D13), but a role change or a deactivation still has to take
+    # effect on live sessions. The value is embedded in the JWT and re-checked on
+    # every request.
     token_version: Mapped[int] = mapped_column(Integer, default=0)
 
     def to_dict(self) -> dict:
-        """Public view of a user — NEVER includes the password hash."""
+        """Public view of a user."""
         return {
             "id": self.id, "username": self.username, "email": self.email,
             "full_name": self.full_name, "role": self.role,