Land admin-issued auth R2 across repos (gitlinks + task card)

Why: R2 spans backend (migration v10, auth/session APIs, CLI user
subcommands), frontend (login page, forced change gate, admin user
management), documents (decision record).

Evidence: make test full suite green on this head (exit 0); headless
journey on the real binary with --auth on covers admin bootstrap,
first-login forced change for created and reset passwords, non-admin
menu gating, API-key login, logout.

Impact: auth-enabled deployments gain password login and admin account
management; embedded no-auth mode unchanged. Merge order: backend ->
frontend -> documents -> this PR.

Refs: proposal 2026-09-30-ui-redesign-and-auth.md (R2 admin-issued)

.task/feature-auth-admin-accounts.md

@@ -6,11 +6,12 @@
 
 - 权威仓：ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Dev.git；目标分支：main；R0（initial_base_sha）= b71ef3e9a857646aec7e46839914f6cc0af1cc9f
 - 工作区：/home/weichen/projects/Agent-System-Dev-wt-feature-auth-admin-accounts（worktree）；分支：feature/auth-admin-accounts
-- 授权与交付终点：<本次允许的动作与终点；未授权事项写明>
+- 授权与交付终点：用户 /goal 指令（2026-09-30）授权实施管理员发放制认证；终点 = 四仓 PR 合入 main + 验证证据落 PR。
 
 ## 目标与非目标
 
-<预期结果、受影响入口/模块/契约；明确不做什么。>
+- 目标（R2，2026-09-30 用户裁定"管理员发放制"）：登录页（用户名+密码 / API 密钥双入口）；账号仅管理员创建（初始密码）或 CLI 引导；创建后与重置后的首次登录强制改密；服务端会话（HttpOnly cookie）；登录失败退避；CLI `user create|reset-password|list`。
+- 非目标：邮箱注册（用户明确否决）、orgs/memberships 多租户成员模型（R3）、计费、SSO。
 
 ## 同步记录