user-reauth: the user form asks for your account password (audit A2)

Security audit 2026-10-17, finding A2 (high), stage 0; the mockup is
2c27275. A stolen global session could set its own password on the user
form - no current password asked, the session kept - and then pass the
backup's reauth with it, or add a second global user with a known
password. Now the user form calls reauth (the backup's check: bcrypt
against the signed-in user's own hash, under auth.AllowPasswordChange) when
it adds a user and when a save sets a password, changes the e-mail (reset
links go there) or changes the role, the own account included; deleting a
user asks too, refused on its own confirmation page (renderUserDelete, a
Flash on UserDelete). Name and reach alone are not asked. Missing or wrong:
401 on the same page, "Your account password is incorrect.", nothing saved.

Tests: TestUserFormAsksForTheAccountPassword (create, each of password,
e-mail, role, own password, reach alone, delete); the user-form tests send
the field (withAccountPassword gives root a real hash and h an auth
module). go vet, go test ./internal/web/... on Windows.

Docs: security.md § Backup and domain export, guide § Users, help word for
word with the mockup; CHANGELOG [Unreleased] Security; plan line ticked.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/security-audit-2026-10-17.md

@@ -685,12 +685,14 @@ the argument.
 
 ### Stage 0 — the high and the cheap guards (~5 h) → patch release
 
-- [ ] **A2.** `reauth` on user create, on a user update that carries
+- [x] **A2.** `reauth` on user create, on a user update that carries
   `password` or changes `role`, and on user delete; the user form gets the
   `account_password` field the Backup page has; security.md § Backup and
   domain export says the user form is covered. Done when a test with a
   session and no password gets 401 on all three and the existing user-form
-  tests pass with the field. — **Opus**, 2 h.
+  tests pass with the field. — **Opus**, 2 h. *Done 2026-10-17:* also on a
+  change of e-mail (where reset links go); a save of the name and the
+  reach alone is not asked; TestUserFormAsksForTheAccountPassword.
 - [ ] **I2.** The three DMARC maps in `drop_links`; `[ -L ]` beside `[ -e ]`
   in postfix-config.sh:538,545; an e2e case plants a link and expects the
   log line. — **Opus**, 0.5 h.