chore(auth): close the password_set contract gap, fix the card's stale form

[ruko1202]

The backend shipped, so the debt RUK-289 left behind came due. me.json is
re-recorded against the live backend and password_set is on the wire, so the
gap row and its absence assertion are gone.

The detector worked as designed: the assertion said the key was ABSENT, so it
was green while the gap was open and went red the moment the fixture was
re-recorded. That is how this got closed rather than quietly forgotten. The
registry row is kept and marked closed, per the file's convention — including a
note that the row's first version named a detector that could not fire.

Only me was re-captured. A full refresh needs a maintenance in the capture
window and this database has none, but the recorder already skips context
resolution for endpoints with a static path, so the narrow capture is the
supported path rather than a workaround.

The recorder masked password_set into the string "<redacted-password_set>" —
SENSITIVE_KEY_RE matches its password prefix. It is a boolean saying whether
an account HAS a password, not a credential, and masking changed its TYPE, which
would fail any test asserting the shape. Added as a narrow allowlist rather than
by loosening the pattern: the rule's asymmetry is right, and a false positive is
fixed by naming it.

Then the live run found a real defect no test could see. asChange was seeded
with useState(passwordSet === true), which runs only on mount, and this card
is never remounted — so setting a password left password_set flipping to
true on the wire while the form still offered "Set password", and the next
submit would omit current_password and earn a 400 the user did nothing to
deserve. It is now derived from the prop, with the one-time flip kept as an
override. Every existing test mounted the component fresh, which is exactly why
they all passed; the new ones re-render with a changed prop instead, and five
tests fail against the old code.

Verified end to end against the local stack: reset requested, code redeemed
(204), session torn down, confirmation shown, sign-in with the new password
works, password_set flips to true, and the profile card switches to the change
form with no reload.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com