user-reauth: the user form asks for your account password (audit A2)

Security audit 2026-10-17, finding A2 (high), stage 0; the mockup is
2c27275. A stolen global session could set its own password on the user
form - no current password asked, the session kept - and then pass the
backup's reauth with it, or add a second global user with a known
password. Now the user form calls reauth (the backup's check: bcrypt
against the signed-in user's own hash, under auth.AllowPasswordChange) when
it adds a user and when a save sets a password, changes the e-mail (reset
links go there) or changes the role, the own account included; deleting a
user asks too, refused on its own confirmation page (renderUserDelete, a
Flash on UserDelete). Name and reach alone are not asked. Missing or wrong:
401 on the same page, "Your account password is incorrect.", nothing saved.

Tests: TestUserFormAsksForTheAccountPassword (create, each of password,
e-mail, role, own password, reach alone, delete); the user-form tests send
the field (withAccountPassword gives root a real hash and h an auth
module). go vet, go test ./internal/web/... on Windows.

Docs: security.md § Backup and domain export, guide § Users, help word for
word with the mockup; CHANGELOG [Unreleased] Security; plan line ticked.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/handlers/handlers_server_email_test.go

@@ -16,10 +16,11 @@ func TestUserFormSetsTheAccountEmail(t *testing.T) {
 	h, st := inboundHandlers(t)
 	out1, _ := st.AddDomain("one.example.com", "mail")
 	root := userWith(t, st, "root", store.RoleGlobal, store.Reach{})
+	withAccountPassword(t, h, st, root)
 
 	rec := send(h.HandleUserNew, &root, "POST", "/server/users/new", nil, url.Values{
 		"username": {"ops"}, "email": {"  ops@acme.io "}, "password": {"a-long-enough-password-1"}, "role": {"domain"},
-		"domain_ids": {idStr(out1.ID)},
+		"domain_ids": {idStr(out1.ID)}, "account_password": {testAccountPassword},
 	})
 	if rec.Code != http.StatusSeeOther {
 		t.Fatalf("create with an e-mail = %d:\n%s", rec.Code, rec.Body.String())
@@ -32,7 +33,7 @@ func TestUserFormSetsTheAccountEmail(t *testing.T) {
 	path, pv := "/server/users/"+idStr(u.ID), map[string]string{"uid": idStr(u.ID)}
 	post := func(extra url.Values) store.User {
 		t.Helper()
-		form := url.Values{"username": {"ops"}, "role": {"domain"}, "domain_ids": {idStr(out1.ID)}}
+		form := url.Values{"username": {"ops"}, "role": {"domain"}, "domain_ids": {idStr(out1.ID)}, "account_password": {testAccountPassword}}
 		for k, v := range extra {
 			form[k] = v
 		}
@@ -54,7 +55,7 @@ func TestUserFormSetsTheAccountEmail(t *testing.T) {
 
 	// Creating without one is fine.
 	rec = send(h.HandleUserNew, &root, "POST", "/server/users/new", nil, url.Values{
-		"username": {"plain"}, "password": {"a-long-enough-password-1"}, "role": {"global"}})
+		"username": {"plain"}, "password": {"a-long-enough-password-1"}, "role": {"global"}, "account_password": {testAccountPassword}})
 	if plain, _ := st.GetUserByUsername("plain"); rec.Code != http.StatusSeeOther || plain.Email != "" {
 		t.Errorf("create without an e-mail = %d, %q", rec.Code, plain.Email)
 	}