- json/users.json: add 2 toolbar tools (selected_row) + script binds,
same pattern as enable_user/disable_user; reset_password collects new
password via prompt and POSTs JSON body to admin_reset_password.dspy
- api/admin_reset_password.dspy: orgid ownership check, min length 8,
cfm match, password_encode (RC4), also resets login_fail counters,
audit_log(password_reset), new password never logged
- api/clear_login_fail.dspy: ownership check, SET login_fail_count=0
last_login_fail=NULL, audit_log(login_fail_clear)
- scripts/load_path.py: new PATHS_ADMIN section registered as *.admin
(NOT logined - sensitive endpoints must not be open to any logged user)
