fix(auth): stop the address-bar mirror eating emailed auth tokens, and unlock revoked accounts

Two independent bugs made an email+password registration unrecoverable in prod.

The verification link did nothing. urlWithParams/clearParams rebuilt the URL as
pathname+query and dropped the fragment — but the one-time auth tokens ride the
fragment (#verify=/#reset=, SB3), and the providers that mirror nav params
(useUrlMirror in FeedFilters/Playlists/Plex/Channels) sit ABOVE the lazily-loaded
<App> in main.tsx. Their mount effect replaceState'd the token away before the auth
card's chunk had loaded, so the card read an empty hash: the link opened a bare
sign-in page, no request, no banner. Both helpers now carry the fragment over.

The account was then locked out for good. SEC-10 nulls password_hash when an
unverified account is attested (here: admin approval landing before the user could
verify — which the bug above made impossible). That is indistinguishable from a
Google-only account, and reset eligibility keyed off password_hash alone, so no
reset link was ever issued: no password to sign in with, and no way to get one.
users.password_revoked_at records the revocation, reset eligibility honours it, and
setting a password again (reset-confirm or set-password) clears it. An account that
never had a password stays ineligible on purpose — its owner adds one from Settings.

/auth/verify now also answers password_reset_required so the card can say why the
registered password stopped working, instead of leaving the user at the uniform
"Invalid email or password". Telling the holder of a valid verify token leaks
nothing: they have already proved they own the mailbox.

The 0078 migration backfills the stamp for rows carrying the exact lockout signature
(local, non-demo, no password, unverified), so existing victims recover unaided.

frontend/src/lib/useUrlMirror.dom.test.ts

@@ -48,4 +48,14 @@ describe("useUrlMirror", () => {
     renderHook(() => useUrlMirror({ pl: "5" }));
     expect(window.location.search).toBe("?page=playlists&pl=5");
   });
+
+  it("leaves an unconsumed auth token in the fragment alone", () => {
+    // This hook's mount effect is what ran before <App> (and therefore before the auth card) had even
+    // loaded, so whatever it writes to the address bar is what the card later reads. It must not eat
+    // the #verify=/#reset= token that the emailed link carries.
+    window.history.replaceState(null, "", "/?page=playlists#verify=tok123");
+    renderHook(() => useUrlMirror({ pl: "5" }));
+    expect(window.location.hash).toBe("#verify=tok123");
+    expect(window.location.search).toBe("?page=playlists&pl=5");
+  });
 });