design: user-reauth - your account password on the user form and user delete

Security audit 2026-10-17, finding A2, stage 0 (the owner, 2026-10-17:
"Выполняй план после аудита"). A stolen global session could set its own
password on the user form and so pass backup-reauth, or add a second global
administrator. The user form gets "Your account password" (autocomplete
current-password) as the last field of box 01, with help that says it is
yours, not the edited user's, and when it is asked: adding a user, changing a
password, an e-mail or a role. Not required in the markup on the edit form -
the server asks only for those changes. The delete page gets the same field,
required, before its buttons. Help's Users topic says all of it. check.py:
0 violations; outlines unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/assets/panel-redesign/panel/user-delete.html

@@ -84,6 +84,8 @@
             </ul>
             <p class="sp-muted mb-4">Applications and their passwords, upstreams and recipients are not affected.</p>
             <form method="post" action="users.html">
+              <div class="field"><label class="label" for="acpw">Your account password</label><div class="control"><input class="input" id="acpw" name="account_password" type="password" autocomplete="current-password" required></div>
+                <p class="help">The one you sign in with: a session left open must not be enough to remove an administrator.</p></div>
               <div class="buttons">
                 <button type="submit" class="button is-danger"><i class="ti ti-trash"></i>Delete acme-ops</button>
                 <a class="button is-text" href="user.html">Keep it</a>