chore(ci): add guard against password handlers that skip base64-decode (regression class of #356) #661

PR #357 (closed #356, P0) fixed a bug where the resetPassword API handler forgot to base64-decode new_password, locking out invited users. PR #357 noted that a CI guard against this class of bug (a handler that accepts a password but skips the decode step) was deferred as a follow-up, but no issue was filed.

Scope:

• Add a CI / lint guard (or a focused test) that catches handlers which read a password field but skip the expected base64-decode step, so the fix(auth/api): password-reset endpoint forgets to base64-decode new_password — invited users locked out #356 regression class cannot silently reappear.

Out of scope when deferred: PR #357 was a targeted P0 fix; the systemic guard is a separate, lower-priority hardening item.

Deferred by: #357
Related: #356 (the original bug, fixed).