fix(auth): close the three leftovers E9.5 logged but kept out of its diff

DX-17, three one-liners the epic's canonical sweep did not reach:

`routes/setup.py::setup_admin` still resolved the wizard's admin by
literal `User.email ==`. The wizard can be re-run, and E9.5's premise is
that two spellings of one Gmail mailbox are one person — so a second run
under the other spelling would have created exactly the duplicate admin
row the epic exists to prevent.

`routes/admin.py::_decide` hand-rolled `db.get` + 404 where the file's
newer endpoints use `get_or_404`. There were TWO such sites, not the one
the review named; both are converted, per the house rule that a
principle gets fixed everywhere in one sweep.

`useVerifyEntry`'s `hashchange` listener recognised `#verify=` but not
`#reset=`, so pasting a reset link into a tab already running the app
was silently ignored — the same silence that made the verify half a bug.
It now notices, and says out loud that reset links need a signed-out
window; the fragment is still deliberately left in the address bar
(review round 4), so signing out from that tab recovers it.

DX-16: `.catch(() => setOutcome("invalid"))` could not tell a spent
token from a 502 mid-deploy or a dropped connection, and by then the
fragment is cleared — so a network blip was reported as "that link is no
longer valid", pushing the user to request a fresh one on the strength
of a false statement. Only a 400 carrying {code:"verify"} is the
server's verdict now; everything else gets its own outcome, with no
resend CTA, because the token is untouched and retrying it works. The
rule was already written one file away for the reset-link probe: "a
network blip must never be cached as 'this link is dead'".

Two existing tests asserted the old conflation by rejecting with a bare
Error("400"); they now reject with the real HttpError. The errors are
built inside the rejection, not hoisted: mountAt calls vi.resetModules(),
so an HttpError imported earlier is a different class identity and
`instanceof` would quietly miss.

Gate: vitest 671 -> 676, pytest 924 -> 925.

frontend/src/components/VerifyBanner.tsx

@@ -14,15 +14,33 @@ import type { VerifyEntry } from "../lib/useVerifyEntry";
 // wrong-account case is why the address is named.
 export default function VerifyBanner({ entry }: { entry: VerifyEntry }) {
   const { t } = useTranslation();
+  // A reset link opened here can only be ACTED on signed out, so say that rather than nothing —
+  // silence is precisely what made the verify half a bug. The token stays in the address bar, so
+  // signing out from this same tab picks it up.
+  if (!entry.outcome && entry.resetPending) {
+    return (
+      <Banner
+        tone="warning"
+        icon={AlertTriangle}
+        role="status"
+        onDismiss={entry.dismiss}
+        dismissTitle={t("header.banner.dismiss")}
+      >
+        {t("header.verify.resetSignedOut")}
+      </Banner>
+    );
+  }
   if (!entry.outcome) return null;
 
-  const ok = entry.outcome !== "invalid";
+  const ok = entry.outcome === "ok" || entry.outcome === "ok_reset";
   const text =
     entry.outcome === "invalid"
       ? t("header.verify.invalid")
-      : entry.email
-        ? t("header.verify.confirmedNamed", { email: entry.email })
-        : t("header.verify.confirmed");
+      : entry.outcome === "unreachable"
+        ? t("header.verify.unreachable")
+        : entry.email
+          ? t("header.verify.confirmedNamed", { email: entry.email })
+          : t("header.verify.confirmed");
 
   return (
     <Banner