design: user-reauth - your account password on the user form and user delete

Security audit 2026-10-17, finding A2, stage 0 (the owner, 2026-10-17:
"Выполняй план после аудита"). A stolen global session could set its own
password on the user form and so pass backup-reauth, or add a second global
administrator. The user form gets "Your account password" (autocomplete
current-password) as the last field of box 01, with help that says it is
yours, not the edited user's, and when it is asked: adding a user, changing a
password, an e-mail or a role. Not required in the markup on the edit form -
the server asks only for those changes. The delete page gets the same field,
required, before its buttons. Help's Users topic says all of it. check.py:
0 violations; outlines unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/assets/panel-redesign/panel/user.html

@@ -87,6 +87,8 @@
               <div class="field"><label class="label" for="role">Role</label>
                 <div class="control"><div class="select is-fullwidth"><select id="role" name="role"><option selected>Domain — the domains assigned below</option><option>Global — the whole server</option></select></div></div>
                 <p class="help">Everyone here is an administrator; the role is the reach. <em>Global</em> also sees Server and is the only one who adds or deletes domains. The only global user cannot be changed to <em>domain</em> or deleted.</p></div>
+              <div class="field"><label class="label" for="acpw">Your account password</label><div class="control"><input class="input" id="acpw" name="account_password" type="password" autocomplete="current-password"></div>
+                <p class="help">Yours, the one you sign in with, not this user's. Asked when you add a user, or change a password, an e-mail or a role here: a session left open must not be enough to hand out an account.</p></div>
             </div>
           </div>
         </div>