user-reauth: the user form asks for your account password (audit A2)

Security audit 2026-10-17, finding A2 (high), stage 0; the mockup is
2c27275. A stolen global session could set its own password on the user
form - no current password asked, the session kept - and then pass the
backup's reauth with it, or add a second global user with a known
password. Now the user form calls reauth (the backup's check: bcrypt
against the signed-in user's own hash, under auth.AllowPasswordChange) when
it adds a user and when a save sets a password, changes the e-mail (reset
links go there) or changes the role, the own account included; deleting a
user asks too, refused on its own confirmation page (renderUserDelete, a
Flash on UserDelete). Name and reach alone are not asked. Missing or wrong:
401 on the same page, "Your account password is incorrect.", nothing saved.

Tests: TestUserFormAsksForTheAccountPassword (create, each of password,
e-mail, role, own password, reach alone, delete); the user-form tests send
the field (withAccountPassword gives root a real hash and h an auth
module). go vet, go test ./internal/web/... on Windows.

Docs: security.md § Backup and domain export, guide § Users, help word for
word with the mockup; CHANGELOG [Unreleased] Security; plan line ticked.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/view/templates/user.html

@@ -4,7 +4,8 @@
      the lists while the role is Global (data-global-role on the select,
      data-domain-pick on the boxes); without scripts they stay in view and the
      server ignores them for the global role. A blank password keeps the current
-     one. */}}
+     one. Your account password is asked for a new user and for a change of
+     password, e-mail or role (audit 2026-10-17, A2); the server decides. */}}
 {{define "content"}}
 {{template "page_head" .Head}}
 {{if .Flash}}{{template "flash" .Flash}}{{end}}
@@ -25,6 +26,8 @@
     <option value="{{.Value}}"{{if eq .Value $sel}} selected{{end}}>{{.Label}}</option>{{end}}
   </select></div></div>
   <p class="help">Everyone here is an administrator; the role is the reach. <em>Global</em> also sees Server and is the only one who adds or deletes domains. The only global user cannot be changed to <em>domain</em> or deleted.</p></div>
+<div class="field"><label class="label" for="acpw">Your account password</label><div class="control"><input class="input" id="acpw" name="account_password" type="password" autocomplete="current-password"{{if .NewUser}} required{{end}}></div>
+  <p class="help">Yours, the one you sign in with, not this user's. Asked when you add a user, or change a password, an e-mail or a role here: a session left open must not be enough to hand out an account.</p></div>
 {{template "body_close"}}
 {{template "box_close"}}
     </div>

internal/web/view/templates/user_delete.html

@@ -2,6 +2,7 @@
      one button that does it, and the way back to the user's form. */}}
 {{define "content"}}
 {{template "page_head" .Head}}
+{{if .Flash}}{{template "flash" .Flash}}{{end}}
 
 <div class="columns">
   <div class="column is-7">
@@ -11,6 +12,8 @@
 {{template "confirm_list" .Consequences}}
 <p class="sp-muted mb-4">{{template "inline" .Note}}</p>
 <form method="post" action="{{.Action}}">
+  <div class="field"><label class="label" for="acpw">Your account password</label><div class="control"><input class="input" id="acpw" name="account_password" type="password" autocomplete="current-password" required></div>
+    <p class="help">The one you sign in with: a session left open must not be enough to remove an administrator.</p></div>
   <div class="buttons">
     <button type="submit" class="button is-danger"><i class="ti ti-trash"></i>{{.Confirm}}</button>
     <a class="button is-text" href="{{.KeepHref}}">Keep it</a>