feat: user management — admin create, password reset, archive/delete, quick invite

Phase 1: must_change_password enforcement + change password endpoint/page
Phase 2: Admin user creation (M365-style) with temp password
Phase 3: Password reset (self-service forgot + admin-triggered)
Phase 4: User archive (soft delete) + hard delete with precheck
Phase 5: Quick invite from admin Users page

Also fixes:
- Auto-create subscription for accounts missing one
- Hard delete precheck ignores sole-member personal accounts
- Seed script patches tree nodes for validation compliance

Migrations: 031 (must_change_password), 032 (password_reset_tokens), 033 (user soft delete)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

frontend/src/pages/ForgotPasswordPage.tsx

@@ -0,0 +1,115 @@
+import { useState } from 'react'
+import { Link } from 'react-router-dom'
+import { authApi } from '@/api/auth'
+import { BrandLogo } from '@/components/common/BrandLogo'
+import { cn } from '@/lib/utils'
+
+export function ForgotPasswordPage() {
+  const [email, setEmail] = useState('')
+  const [isLoading, setIsLoading] = useState(false)
+  const [submitted, setSubmitted] = useState(false)
+
+  const handleSubmit = async (e: React.FormEvent) => {
+    e.preventDefault()
+    if (!email) return
+
+    setIsLoading(true)
+    try {
+      await authApi.forgotPassword(email)
+    } catch {
+      // Always show success (anti-enumeration)
+    } finally {
+      setIsLoading(false)
+      setSubmitted(true)
+    }
+  }
+
+  return (
+    <div className="flex min-h-screen items-center justify-center bg-black px-4">
+      <div className="pointer-events-none fixed inset-0 bg-[radial-gradient(circle_at_50%_0%,rgba(100,100,120,0.03),transparent_50%)]" />
+
+      <div className="relative w-full max-w-md space-y-8">
+        <div className="text-center">
+          <div className="mb-4 flex justify-center sm:mb-6">
+            <div className="w-16 h-16 rounded-2xl bg-white flex items-center justify-center sm:w-20 sm:h-20">
+              <BrandLogo size="lg" className="h-10 w-10 invert sm:h-12 sm:w-12" />
+            </div>
+          </div>
+          <h1 className="text-3xl font-bold text-white tracking-tight">
+            Reset Password
+          </h1>
+          <p className="mt-2 text-sm text-white/40">
+            Enter your email and we'll send you a link to reset your password.
+          </p>
+        </div>
+
+        {submitted ? (
+          <div className="glass-card rounded-2xl p-6 space-y-4">
+            <div className="rounded-xl border border-green-400/20 bg-green-400/10 p-4 text-sm text-green-400">
+              If an account with that email exists, we've sent a password reset link.
+              Check your inbox and follow the instructions.
+            </div>
+            <div className="text-center">
+              <Link
+                to="/login"
+                className="text-sm text-white/60 hover:text-white transition-colors"
+              >
+                Back to sign in
+              </Link>
+            </div>
+          </div>
+        ) : (
+          <form onSubmit={handleSubmit} className="mt-8 space-y-6">
+            <div className="glass-card rounded-2xl p-6 space-y-4">
+              <div>
+                <label htmlFor="email" className="mb-1 block text-sm font-medium text-white">
+                  Email Address
+                </label>
+                <input
+                  id="email"
+                  type="email"
+                  autoComplete="email"
+                  required
+                  value={email}
+                  onChange={(e) => setEmail(e.target.value)}
+                  className={cn(
+                    'block w-full rounded-xl border border-white/10 bg-black/50 px-3 py-2',
+                    'text-white placeholder:text-white/30',
+                    'focus:border-white/30 focus:outline-none focus:ring-1 focus:ring-white/20',
+                    'transition-colors'
+                  )}
+                  placeholder="you@example.com"
+                />
+              </div>
+
+              <button
+                type="submit"
+                disabled={isLoading || !email}
+                className={cn(
+                  'w-full rounded-xl px-4 py-2.5 text-sm font-semibold btn-press',
+                  'bg-white text-black hover:bg-white/90',
+                  'focus:outline-none focus:ring-2 focus:ring-white/30 focus:ring-offset-2 focus:ring-offset-black',
+                  'disabled:cursor-not-allowed disabled:opacity-50',
+                  'transition-all'
+                )}
+              >
+                {isLoading ? 'Sending...' : 'Send Reset Link'}
+              </button>
+
+              <div className="text-center">
+                <Link
+                  to="/login"
+                  className="text-sm text-white/60 hover:text-white transition-colors"
+                >
+                  Back to sign in
+                </Link>
+              </div>
+            </div>
+          </form>
+        )}
+      </div>
+    </div>
+  )
+}
+
+export default ForgotPasswordPage