fix(ci): pgconn import path + reset-password token type + SMTP label

Three CI fixes from the U1+U2+U3 push:

- internal/api/admin_users.go imported the standalone
  github.com/jackc/pgconn — that module isn't in go.sum and
  go vet caught it. Switch to github.com/jackc/pgx/v5/pgconn
  (the path used elsewhere in the package, e.g. auth_register.go
  and me_profile.go).

- /reset-password/[token] dereferenced page.params.token without
  the undefined narrowing svelte-kit's typegen requires. Coalesce
  to '' on read and reject empty token at submit time with a
  clear error.

- /admin/integrations SMTP card had a label without an associated
  control as the TLS row's leading column header. Switched to a
  span — the actual checkbox lives in the wrapping label below it.

internal/api/admin_users.go

@@ -7,9 +7,9 @@ import (
 	"time"
 
 	"github.com/go-chi/chi/v5"
-	"github.com/jackc/pgconn"
 	"github.com/jackc/pgerrcode"
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 	"golang.org/x/crypto/bcrypt"
 
 	"git.fabledsword.com/bvandeusen/minstrel/internal/audit"

web/src/routes/admin/integrations/+page.svelte

@@ -594,7 +594,7 @@
       <input id="smtp-from-name" type="text" bind:value={smtpForm.from_name}
              class="mt-1 w-full rounded-md border border-border bg-background px-3 py-2 font-mono text-sm text-text-primary placeholder:text-text-muted focus:outline-none focus:ring-2 focus:ring-accent" />
 
-      <label class="text-sm text-text-secondary">TLS</label>
+      <span class="text-sm text-text-secondary">TLS</span>
       <label class="flex items-center gap-2 text-sm">
         <input type="checkbox" bind:checked={smtpForm.use_tls} />
         Use STARTTLS

web/src/routes/reset-password/[token]/+page.svelte

@@ -9,11 +9,15 @@
   let submitting = $state(false);
   let error = $state<string | null>(null);
 
-  const token = $derived(page.params.token);
+  const token = $derived(page.params.token ?? '');
 
   async function onSubmit(e: SubmitEvent) {
     e.preventDefault();
     error = null;
+    if (!token) {
+      error = 'This reset link is invalid. Request a new one.';
+      return;
+    }
     if (newPassword !== confirmPassword) {
       error = 'Passwords do not match.';
       return;