weichenandCursor
479b7afa33
Walk the live password-change gate in k6 load setup
Why: Admin-created load users still have must_change; business APIs return 403 text and k6 json() crashes.
Evidence: brew k6 v2.3.0 smoke --seed tiny (653/653 checks, fail=0); --instances 2 (765/765, cross-read 30, dup_seq=0).
Impact: Load suite matches the real first-login set-password flow; no SQL backdoor for k6 users.
Refs: server/auth.go enforcePasswordGate; U7 run_load.sh
Co-authored-by: Cursor <cursoragent@cursor.com>