fix(ci): pgconn import path + reset-password token type + SMTP label

Three CI fixes from the U1+U2+U3 push:

- internal/api/admin_users.go imported the standalone
  github.com/jackc/pgconn — that module isn't in go.sum and
  go vet caught it. Switch to github.com/jackc/pgx/v5/pgconn
  (the path used elsewhere in the package, e.g. auth_register.go
  and me_profile.go).

- /reset-password/[token] dereferenced page.params.token without
  the undefined narrowing svelte-kit's typegen requires. Coalesce
  to '' on read and reject empty token at submit time with a
  clear error.

- /admin/integrations SMTP card had a label without an associated
  control as the TLS row's leading column header. Switched to a
  span — the actual checkbox lives in the wrapping label below it.

web/src/routes/reset-password/[token]/+page.svelte

@@ -9,11 +9,15 @@
   let submitting = $state(false);
   let error = $state<string | null>(null);
 
-  const token = $derived(page.params.token);
+  const token = $derived(page.params.token ?? '');
 
   async function onSubmit(e: SubmitEvent) {
     e.preventDefault();
     error = null;
+    if (!token) {
+      error = 'This reset link is invalid. Request a new one.';
+      return;
+    }
     if (newPassword !== confirmPassword) {
       error = 'Passwords do not match.';
       return;