user-reauth: the user form asks for your account password (audit A2)

Security audit 2026-10-17, finding A2 (high), stage 0; the mockup is
2c27275. A stolen global session could set its own password on the user
form - no current password asked, the session kept - and then pass the
backup's reauth with it, or add a second global user with a known
password. Now the user form calls reauth (the backup's check: bcrypt
against the signed-in user's own hash, under auth.AllowPasswordChange) when
it adds a user and when a save sets a password, changes the e-mail (reset
links go there) or changes the role, the own account included; deleting a
user asks too, refused on its own confirmation page (renderUserDelete, a
Flash on UserDelete). Name and reach alone are not asked. Missing or wrong:
401 on the same page, "Your account password is incorrect.", nothing saved.

Tests: TestUserFormAsksForTheAccountPassword (create, each of password,
e-mail, role, own password, reach alone, delete); the user-form tests send
the field (withAccountPassword gives root a real hash and h an auth
module). go vet, go test ./internal/web/... on Windows.

Docs: security.md § Backup and domain export, guide § Users, help word for
word with the mockup; CHANGELOG [Unreleased] Security; plan line ticked.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/guide.md

@@ -719,6 +719,12 @@ The panel refuses to remove or demote the **last** global user, so it can never
 end up with none. A user cannot delete the account they are signed in with.
 The user form also sets the user's e-mail, which the users list shows.
 
+Adding a user, setting a user's password, changing their e-mail or role -
+your own account's included - and deleting a user ask for **your account
+password**, the one you sign in with, as a backup does and under the same
+limit on wrong guesses: a session left open is not enough to hand out an
+account. Saving only the name or the domain assignments is not asked.
+
 ### Sessions
 
 A login survives a container restart: sessions live in SQLite, not in