Add admin password reset option for users (#5180)

## Summary
- add backend support for admins to reset user passwords and optionally
email notifications when SMTP is enabled
- surface mail capability in admin settings data for the UI
- add a shared change-password modal hooked into People and Team user
actions with random password generation and email options

## Testing
- not run (not requested)


------
[Codex
Task](https://chatgpt.com/codex/tasks/task_b_6934b978fe3c83289b5b95dec79b3d38)

---------

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

frontend/src/core/components/onboarding/orchestrator/useOnboardingOrchestrator.ts

@@ -195,7 +195,7 @@ export function useOnboardingOrchestrator(
           accountService.getAccountData(),
           accountService.getLoginPageData(),
         ]);
-        
+
         setRuntimeState((prev) => ({
           ...prev,
           requiresPasswordChange: accountData.changeCredsFlag,
@@ -226,8 +226,12 @@ export function useOnboardingOrchestrator(
   }), [serverExperience, runtimeState]);
 
   const activeFlow = useMemo(() => {
+    // If password change is required, ONLY show the first-login step
+    if (runtimeState.requiresPasswordChange) {
+      return ONBOARDING_STEPS.filter((step) => step.id === 'first-login');
+    }
     return ONBOARDING_STEPS.filter((step) => step.condition(conditionContext));
-  }, [conditionContext]);
+  }, [conditionContext, runtimeState.requiresPasswordChange]);
 
   // Wait for config AND admin status before calculating initial step
   const adminStatusResolved = !configLoading && (
@@ -238,23 +242,31 @@ export function useOnboardingOrchestrator(
   
   useEffect(() => {
     if (configLoading || !adminStatusResolved || activeFlow.length === 0) return;
-    
+
     let firstUnseenIndex = -1;
     for (let i = 0; i < activeFlow.length; i++) {
-      if (!hasSeenStep(activeFlow[i].id)) {
+      // Special case: first-login step should always be considered "unseen" if requiresPasswordChange is true
+      const isFirstLoginStep = activeFlow[i].id === 'first-login';
+      const shouldTreatAsUnseen = isFirstLoginStep ? runtimeState.requiresPasswordChange : !hasSeenStep(activeFlow[i].id);
+
+      if (shouldTreatAsUnseen) {
         firstUnseenIndex = i;
         break;
       }
     }
-    
-    if (firstUnseenIndex === -1) {
+
+    // Force reset index when password change is required (overrides initialIndexSet)
+    if (runtimeState.requiresPasswordChange && firstUnseenIndex === 0) {
+      setCurrentStepIndex(0);
+      initialIndexSet.current = true;
+    } else if (firstUnseenIndex === -1) {
       setCurrentStepIndex(activeFlow.length);
       initialIndexSet.current = true;
     } else if (!initialIndexSet.current) {
       setCurrentStepIndex(firstUnseenIndex);
       initialIndexSet.current = true;
     }
-  }, [activeFlow, configLoading, adminStatusResolved]);
+  }, [activeFlow, configLoading, adminStatusResolved, runtimeState.requiresPasswordChange]);
 
   const totalSteps = activeFlow.length;
   
@@ -303,10 +315,13 @@ export function useOnboardingOrchestrator(
     if (!currentStep || isLoading) {
       return;
     }
-    if (hasSeenStep(currentStep.id)) {
+    // Special case: never auto-complete first-login step if requiresPasswordChange is true
+    const isFirstLoginStep = currentStep.id === 'first-login';
+
+    if (!isFirstLoginStep && hasSeenStep(currentStep.id)) {
       complete();
     }
-  }, [currentStep, isLoading, complete]);
+  }, [currentStep, isLoading, complete, runtimeState.requiresPasswordChange]);
 
   const updateRuntimeState = useCallback((updates: Partial<OnboardingRuntimeState>) => {
     persistRuntimeState(updates);