Why: Backend login_keys gate blocks Key traffic while must_change_password is set; U7 failed on PUT settings/user 403. Evidence: go test -c multi-instance compiles; CI test-pg will GATE. Impact: loginAlice does session password change alicePass0→alicePass. Refs: Dev PR #426; Backend #170 pin e7b70c2 Co-authored-by: Cursor <cursoragent@cursor.com>