fix(auth): the Subsonic password is generated, never the login password (M462 #5026)

`minstrel admin reset-password` copied the new login password into
subsonic_password, which is stored in plain text because Subsonic t/s
sign-in needs it. Every account recovered through the CLI had its login
password readable in the database, and changing the password later left
the copy behind.

- reset-password now changes only password_hash.
- Migration 0064 clears every subsonic_password, removing the copies.
- Settings gets a Subsonic password card: the server generates a random
  password, shows it once, and it can be regenerated or turned off
  (GET/POST/DELETE /api/me/subsonic-password, audited). Generated rather
  than user-chosen so it can never be a reused password.
- docs/security.md describes the separate password instead of the known
  issue.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/security.md

@@ -54,20 +54,24 @@ they aren't checked.
 Classic Subsonic clients sign in with `t` and `s`: the MD5 of the password
 followed by a random salt. To check that, the server has to know the password
 itself, so supporting this sign-in method means storing a password Minstrel
-can read. That is the `subsonic_password` column, and it is the only
-credential Minstrel keeps unhashed.
+can read. That is the Subsonic password, and it is the only credential
+Minstrel keeps unhashed.
 
 - **The recommended way in is the API key.** Clients that support the
   OpenSubsonic `apiKey` should use it. The key is stored hashed and can be
   replaced at any time in Settings.
-- **`t`/`s` and `p=` sign-in are off for an account until its
-  `subsonic_password` is set**, and nothing in the app sets it. Plain `p=`
-  sign-in is additionally off server-wide unless
+- **The Subsonic password is never your login password.** Minstrel generates
+  it (**Settings → Subsonic password**), shows it once, and lets you replace
+  or turn it off. Because it is random, a copy of the database exposes access
+  to this server's Subsonic API and nothing else: it can't be a password you
+  also use somewhere else.
+- **`t`/`s` and `p=` sign-in are off for an account until it has a Subsonic
+  password.** Plain `p=` sign-in is additionally off server-wide unless
   `subsonic.allow_plaintext_password` is enabled.
-- **Known issue:** `minstrel admin reset-password` writes the new login
-  password into `subsonic_password` as well, so `t`/`s` clients keep working
-  after a recovery. For an account reset that way, the login password is
-  stored in plain text until the column is cleared.
+- `minstrel admin reset-password` changes only the login password. Older
+  versions also copied it into the Subsonic password; upgrading clears every
+  Subsonic password once, so those copies are gone. An account that used
+  `t`/`s` sign-in needs a new Subsonic password generated in Settings.
 
 ## Android allows plain HTTP