feat(#9547): require password reset on first time login and admin password update

[Benmuiruri]

Description

Video showing password reset in action

Screen.Recording.2025-01-10.at.10.29.17.mov

Video showing permission enabling skipping password reset

Screen.Recording.2025-01-10.at.10.32.14.mov

Video showing api supports setting password_change_required: false for specific user

Screen.Recording.2025-01-10.at.10.44.23.mov

Closes #9547

Code review checklist

• UI/UX backwards compatible: Test it works for the new design (enabled by default). And test it works in the old design, enable can_view_old_navigation permission to see the old design.
• Readable: Concise, well named, follows the style guide, documented if necessary.
• Documented: Configuration and user documentation on cht-docs
• Tested: Unit and/or e2e where appropriate
• Internationalised: All user facing text
• Backwards compatible: Works with existing data and configuration or includes a migration. Any breaking changes documented in the release notes.

Compose URLs

If Build CI hasn't passed, these may 404:

• Core
• CouchDB Single
• CouchDB Cluster

License

The software is provided under AGPL-3.0. Contributions to this project are accepted under the same license.

[Benmuiruri]

Hi @jkuester I resolved the feedback you gave me and this implementation is leaner than the previous one. It is now ready for review.