fix(auth): the Subsonic password is generated, never the login password (M462 #5026)

`minstrel admin reset-password` copied the new login password into
subsonic_password, which is stored in plain text because Subsonic t/s
sign-in needs it. Every account recovered through the CLI had its login
password readable in the database, and changing the password later left
the copy behind.

- reset-password now changes only password_hash.
- Migration 0064 clears every subsonic_password, removing the copies.
- Settings gets a Subsonic password card: the server generates a random
  password, shows it once, and it can be regenerated or turned off
  (GET/POST/DELETE /api/me/subsonic-password, audited). Generated rather
  than user-chosen so it can never be a reused password.
- docs/security.md describes the separate password instead of the known
  issue.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/minstrel/admin.go

@@ -55,12 +55,14 @@ func runAdmin(args []string) error {
 	}
 }
 
-// adminResetPassword resets a user's credentials. It updates BOTH
-// password_hash (bcrypt, for /api/auth/login) and subsonic_password
-// (plaintext, required for Subsonic t+s token verification) so neither
-// auth path is left stale. Recovers a locked-out operator when the
-// bootstrap password was missed or the DB volume was recreated (Fable
-// #321) without DB surgery.
+// adminResetPassword resets a user's login password (password_hash). It
+// recovers a locked-out operator when the bootstrap password was missed or
+// the DB volume was recreated (Fable #321) without DB surgery.
+//
+// It deliberately leaves subsonic_password alone. That column is stored in
+// plain text, and it used to receive the new login password here, so any
+// account recovered this way had its login password readable in the database
+// (#5026). The Subsonic password is generated separately in Settings.
 func adminResetPassword(args []string) error {
 	fs := flag.NewFlagSet("admin reset-password", flag.ContinueOnError)
 	configPath := fs.String("config", os.Getenv("MINSTREL_CONFIG"), "path to YAML config file")
@@ -112,13 +114,6 @@ func adminResetPassword(args []string) error {
 	}); err != nil {
 		return fmt.Errorf("update password_hash: %w", err)
 	}
-	sp := pw
-	if err := q.SetSubsonicPassword(ctx, dbq.SetSubsonicPasswordParams{
-		ID:               user.ID,
-		SubsonicPassword: &sp,
-	}); err != nil {
-		return fmt.Errorf("update subsonic_password: %w", err)
-	}
 
 	if generated {
 		fmt.Printf("minstrel: password for %q reset.\nNew password: %s\n", *username, pw)