Add password reset feature for admin users, enforce password change on login, and enhance session management

src/lib/db.ts

@@ -29,6 +29,7 @@ function ensureSchema() {
       password_hash TEXT NOT NULL,
       role TEXT NOT NULL CHECK (role IN ('admin', 'member')),
       active INTEGER NOT NULL DEFAULT 1 CHECK (active IN (0, 1)),
+      must_change_password INTEGER NOT NULL DEFAULT 0 CHECK (must_change_password IN (0, 1)),
       deleted_at TEXT,
       created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
     ) STRICT;
@@ -226,6 +227,11 @@ function ensureSchema() {
   if (!userColumns.some((column) => column.name === "deleted_at")) {
     db.exec("ALTER TABLE users ADD COLUMN deleted_at TEXT");
   }
+  if (!userColumns.some((column) => column.name === "must_change_password")) {
+    db.exec(
+      "ALTER TABLE users ADD COLUMN must_change_password INTEGER NOT NULL DEFAULT 0 CHECK (must_change_password IN (0, 1))",
+    );
+  }
 
   const motorcycleColumns = db.prepare("PRAGMA table_info(motorcycles)").all() as { name: string }[];
   if (!motorcycleColumns.some((column) => column.name === "tire_pressure_front_bar")) {