Fix single sign-on from the web, and make passwords changeable

Why: two questions about operating this turned up two gaps. "Where do I get
the admin password" had no answer once the line scrolled out of the log,
and "how do I set up OIDC" ran straight into a sign-in link that could not
work.

What:
- /oidc/login with no parameters now signs a browser in and ends in a
  session cookie. It previously required the user code of a waiting client,
  so the link on the web sign-in page always failed. With a code it still
  approves a device, and the two paths no longer overlap: an empty user
  code matches no pending device.
- POST /api/v1/auth/password, `keeporg passwd`, and a form on /web/vaults.
  Changing a password requires the current one, and the one-time code when
  a second factor is enrolled, and revokes that account's other sessions.
  Until now nothing could change a password, which made the advice printed
  at first start impossible to follow.
- keeporgd -reset-admin, for when that first password was not kept: a new
  one printed once, any second factor cleared, sessions revoked. It writes
  the state document directly and says to stop the server first.
- The client read stdin through a new buffered reader per prompt, so the
  first prompt swallowed the rest and anything asking twice could not be
  scripted. One shared reader now. A prompt for a password being set no
  longer reads $KEEPORG_PASSWORD either; that variable holds the password
  you sign in with, and taking it here would have set the new password to
  the old one.
- HANDOVER gains a first-sign-in section and an OIDC setup section covering
  the redirect URI, the config block, both entry points and how an identity
  becomes an account.

Proved: OIDC now has tests, against a stub provider that serves discovery,
authorization, token and userinfo. They cover the web sign-in that was
broken, device approval, linking an existing account by username, the
refusal when auto_create is off, and a forged callback state. Eight more
cover the password change. Checked by hand with the real binaries: the
first-start password logs once and works, -reset-admin replaces it while
the old one stops working, and `keeporg passwd` changes it from a pipe.
Server 0.5.0, desktop clients 0.3.0.

docs/PROTOCOL.md

@@ -5,8 +5,11 @@ Every `/api/` endpoint takes and returns JSON and needs
 endpoints. Errors carry `{"code": "...", "error": "..."}`; `code` is stable
 and meant to be matched on, `error` is for humans.
 
-HTML is served at `/web` (sign in, list vaults, create one) and at `/device`,
-`/invite/{token}` and `/oidc/callback`. The web pages use the same session
+HTML is served at `/web` (sign in, list vaults, create one, change your
+password) and at `/device`, `/invite/{token}`, `/oidc/login` and
+`/oidc/callback`. `/oidc/login` with no parameters signs a browser in and
+ends in a session cookie; with `?code=<user code>` it approves a waiting
+client instead and ends in a token that client polls for. The web pages use the same session
 tokens in a cookie that is `HttpOnly`, `SameSite=Strict` and `Secure` behind
 https, and every form carries a per-session CSRF token.
 
@@ -17,6 +20,7 @@ https, and every form carries a per-session CSRF token.
 | POST | `/api/v1/auth/login` | `{username, password, totp, label}` | `{token, expires_at, user}`; `401 totp_required` when a second factor is enrolled and missing, `401 totp_invalid`, `401 bad_credentials` |
 | POST | `/api/v1/auth/logout` | – | revokes the calling token |
 | GET | `/api/v1/auth/whoami` | – | the account and its group memberships |
+| POST | `/api/v1/auth/password` | `{current_password, new_password, totp}` | changes the account password; the current one is required, and the second factor when enrolled. Every other session of that account is revoked |
 | POST | `/api/v1/auth/totp/enroll` | – | `{secret, uri}`; not active until confirmed |
 | POST | `/api/v1/auth/totp/confirm` | `{code}` | `{totp_enabled: true}` |
 | POST | `/api/v1/auth/device/start` | `{label}` | `{device_code, user_code, verification_url, interval, expires_in}` |