Fix single sign-on from the web, and make passwords changeable

Why: two questions about operating this turned up two gaps. "Where do I get
the admin password" had no answer once the line scrolled out of the log,
and "how do I set up OIDC" ran straight into a sign-in link that could not
work.

What:
- /oidc/login with no parameters now signs a browser in and ends in a
  session cookie. It previously required the user code of a waiting client,
  so the link on the web sign-in page always failed. With a code it still
  approves a device, and the two paths no longer overlap: an empty user
  code matches no pending device.
- POST /api/v1/auth/password, `keeporg passwd`, and a form on /web/vaults.
  Changing a password requires the current one, and the one-time code when
  a second factor is enrolled, and revokes that account's other sessions.
  Until now nothing could change a password, which made the advice printed
  at first start impossible to follow.
- keeporgd -reset-admin, for when that first password was not kept: a new
  one printed once, any second factor cleared, sessions revoked. It writes
  the state document directly and says to stop the server first.
- The client read stdin through a new buffered reader per prompt, so the
  first prompt swallowed the rest and anything asking twice could not be
  scripted. One shared reader now. A prompt for a password being set no
  longer reads $KEEPORG_PASSWORD either; that variable holds the password
  you sign in with, and taking it here would have set the new password to
  the old one.
- HANDOVER gains a first-sign-in section and an OIDC setup section covering
  the redirect URI, the config block, both entry points and how an identity
  becomes an account.

Proved: OIDC now has tests, against a stub provider that serves discovery,
authorization, token and userinfo. They cover the web sign-in that was
broken, device approval, linking an existing account by username, the
refusal when auto_create is off, and a forged callback state. Eight more
cover the password change. Checked by hand with the real binaries: the
first-start password logs once and works, -reset-admin replaces it while
the old one stops working, and `keeporg passwd` changes it from a pipe.
Server 0.5.0, desktop clients 0.3.0.

internal/server/pages.go

@@ -32,6 +32,9 @@ background:var(--accent);border:0;border-radius:8px;cursor:pointer}
 .err{margin:0 0 1rem;padding:.6rem .7rem;border-radius:8px;background:#f8d7da;color:#842029;font-size:.9rem}
 .alt{display:block;margin-top:1rem;text-align:center;font-size:.9rem;color:var(--accent)}
 code{font-size:1.1rem;letter-spacing:.08em}
+details{margin-top:1.5rem;border-top:1px solid var(--line);padding-top:1rem}
+summary{cursor:pointer;font-size:.9rem;font-weight:600}
+details p.sub{margin:.6rem 0 0}
 header{display:flex;align-items:baseline;justify-content:space-between;gap:1rem;flex-wrap:wrap}
 header form{margin:0}
 header button{width:auto;margin:0;padding:.35rem .7rem;font-size:.85rem;font-weight:500;
@@ -157,6 +160,24 @@ by whoever controls the server. Any other setting keeps the key off the server.<
 <p class="empty">You do not administer a group yet, so there is nowhere to put a
 vault. Ask an administrator to add you to one.</p>
 {{end}}
+
+<details>
+<summary>Change your account password</summary>
+<p class="sub">This is the password you sign in with, not any vault's password.
+Changing it signs out your other sessions.</p>
+<form method="post" action="/web/password">
+<input type="hidden" name="csrf" value="{{.CSRF}}">
+<label for="current_password">Current password</label>
+<input id="current_password" name="current_password" type="password" autocomplete="current-password" required>
+<label for="cp_totp">One-time code <small>(if enabled)</small></label>
+<input id="cp_totp" name="totp" inputmode="numeric" autocomplete="one-time-code">
+<label for="new_password">New password</label>
+<input id="new_password" name="new_password" type="password" autocomplete="new-password" minlength="10" required>
+<label for="new_password2">Repeat new password</label>
+<input id="new_password2" name="new_password2" type="password" autocomplete="new-password" minlength="10" required>
+<button type="submit">Change password</button>
+</form>
+</details>
 {{end}}`))
 
 var doneTmpl = template.Must(template.Must(pages.Clone()).Parse(`