Clear must_change before API-key use in multi-instance U7

Why: Backend login_keys gate blocks Key traffic while
must_change_password is set; U7 failed on PUT settings/user 403.
Evidence: go test -c multi-instance compiles; CI test-pg will GATE.
Impact: loginAlice does session password change alicePass0→alicePass.
Refs: Dev PR #426; Backend #170 pin e7b70c2

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/integration/multi-instance/multi_instance_test.go

@@ -21,6 +21,7 @@ import (
 	"io"
 	"net"
 	"net/http"
+	"net/http/cookiejar"
 	"net/url"
 	"os"
 	"os/exec"
@@ -370,9 +371,24 @@ func (e *env) killNine(t *testing.T, inst *instance) {
 
 // loginAlice 引导 alice 账号并发放 API key（CLI 直连测试库；key 存共享 PG，
 // 对两实例同时有效——程序化验收的首选凭证，SSE 亦可用 ?key= 兜底）。
+// 建号后 must_change=1：API Key 在改密完成前不能走业务接口（login_keys 门禁），
+// 故先经会话完成 alicePass0→alicePass，再发 Key。
 func (e *env) loginAlice(t *testing.T) *userClient {
 	t.Helper()
-	e.cli(t, "user", "create", "--dsn", e.dbDSN, "--owner", aliceOwner, "--name", "Alice", "--password", alicePass)
+	e.cli(t, "user", "create", "--dsn", e.dbDSN, "--owner", aliceOwner, "--name", "Alice", "--password", alicePass0)
+	jar, err := cookiejar.New(nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	sess := &http.Client{Timeout: httpWait, Jar: jar}
+	// e.uc 尚未赋值 → baseFor 走 A；会话 cookie 落 jar 后改密清 must_change。
+	e.do(t, sess, "POST", "/api/auth/login", map[string]any{
+		"owner": aliceOwner, "password": alicePass0,
+	}, nil)
+	e.do(t, sess, "POST", "/api/auth/password", map[string]any{
+		"current": alicePass0, "next": alicePass,
+	}, nil)
+
 	key := e.cliOut(t, "apikey", "create", "--dsn", e.dbDSN, "--owner", aliceOwner, "--name", "mi-acceptance")
 	uc := &userClient{
 		api:     &http.Client{Timeout: httpWait, Transport: bearerRT{key: key}},