Add admin-issued accounts with forced first-login password change

Why: the user ruled out self-registration (2026-09-30): accounts are
created only by admins who set an initial password; first login (and
first login after any admin reset) must force a password change.

Evidence:
- migration v10 auth_accounts (users password/must_change/is_admin +
  sessions table; upgrade test walks v1<->v10 both directions).
- argon2id hash/verify with PHC encoding; store tests cover hash
  roundtrip, duplicate-owner conflict, must-change lifecycle, session
  keep/except semantics.
- e2e TestAdminAccountFlow: static login page reachable without auth,
  wrong password 401, login sets HttpOnly cookie + mustChangePassword,
  admin creates user (409 on duplicate), non-admin create 403, forced
  change clears flag and old password dies, admin reset revokes sessions
  and re-arms forced change, API-key channel untouched, 5-fail backoff
  429, logout kills session. Full go test ./... green.

Impact: middleware now accepts Bearer key OR session cookie and exempts
static + /api/auth/login (also fixes the latent case where the login
page itself could 401). Embedded no-auth mode unchanged.

Refs: proposal 2026-09-30-ui-redesign-and-auth.md section 5 (admin-issued
variant, user decision 2026-09-30)

cmd/agent-system/main.go

@@ -28,6 +28,8 @@ func main() {
 			os.Exit(runAPIKey(os.Args[2:]))
 		case "config":
 			os.Exit(runConfig(os.Args[2:]))
+		case "user":
+			os.Exit(runUser(os.Args[2:]))
 		}
 	}
 	fs := flag.NewFlagSet("serve", flag.ExitOnError)
@@ -144,3 +146,65 @@ func runAPIKey(args []string) int {
 		return 2
 	}
 }
+
+// runUser：用户账号管理子命令（管理员发放制，R2）——create / reset-password / list。
+// 密码未显式给定时生成随机值，明文仅此一次输出；创建/重置后首次登录强制改密。
+func runUser(args []string) int {
+	if len(args) == 0 {
+		fmt.Fprintln(os.Stderr, "用法：agent-system user <create|reset-password|list> [--owner x --name y --admin --password p]")
+		return 2
+	}
+	sub := args[0]
+	fs := flag.NewFlagSet("user "+sub, flag.ExitOnError)
+	data := fs.String("data", "./data", "数据目录")
+	dsn := fs.String("dsn", "", "PostgreSQL 档 DSN（空 = 嵌入式档）")
+	owner := fs.String("owner", "", "用户名（owner）")
+	name := fs.String("name", "", "显示名")
+	password := fs.String("password", "", "密码（空 = 随机生成并打印一次）")
+	admin := fs.Bool("admin", false, "管理员（可管理用户与密钥）")
+	fs.Parse(args[1:])
+	switch sub {
+	case "create":
+		if *owner == "" {
+			fmt.Fprintln(os.Stderr, "user create: --owner 必填")
+			return 2
+		}
+		pw, err := app.CreateUserAccount(*dsn, *data, *owner, *name, *password, *admin)
+		if err != nil {
+			fmt.Fprintln(os.Stderr, "user create:", err)
+			return 1
+		}
+		fmt.Println(pw)
+		if *password == "" {
+			fmt.Fprintln(os.Stderr, "初始密码仅此一次输出；该用户首次登录须修改密码。")
+		}
+		return 0
+	case "reset-password":
+		if *owner == "" {
+			fmt.Fprintln(os.Stderr, "user reset-password: --owner 必填")
+			return 2
+		}
+		pw, err := app.ResetUserPassword(*dsn, *data, *owner, *password)
+		if err != nil {
+			fmt.Fprintln(os.Stderr, "user reset-password:", err)
+			return 1
+		}
+		fmt.Println(pw)
+		if *password == "" {
+			fmt.Fprintln(os.Stderr, "新密码仅此一次输出；该用户下次登录须修改密码（其余会话已吊销）。")
+		}
+		return 0
+	case "list":
+		users, err := app.ListUserAccounts(*dsn, *data)
+		if err != nil {
+			fmt.Fprintln(os.Stderr, "user list:", err)
+			return 1
+		}
+		out, _ := json.MarshalIndent(users, "", "  ")
+		fmt.Println(string(out))
+		return 0
+	default:
+		fmt.Fprintln(os.Stderr, "user: 未知子命令", sub)
+		return 2
+	}
+}