Cover authentication, session, and password lifecycle

[dantro86]

Summary

• cover login metadata plus server-side and repeated logout
• cover self-service password changes, incorrect-current-password rejection, cross-user denial, and administrator reset
• use stable typed fixture users with baseline-password restoration because v2.19.12 cannot delete users with login history
• keep all password values redacted from model diagnostics, HTTP attachments, Allure, and JUnit output
• add a green known-gap canary showing that another active session survives a password change

Product finding

Semaphore v2.19.12 updates the password hash but does not expire existing sessions. The same source boundary remains on upstream develop at 83bddaf0. The account-recovery impact, reproducer, and suggested fix are documented in test-environment/password-change-session-revocation-gap.md.

API coverage

This PR adds three documented operations on top of current main:

• GET /api/auth/login
• POST /api/auth/logout
• POST /api/users/{user_id}/password

Documented coverage moves from 58/99 to 61/99 on this branch. Once PR #31 is merged as well, the cumulative result is expected to be 74/99.

Verification

• JAVA_HOME=/opt/homebrew/opt/openjdk@21 ./gradlew qualityGate --no-daemon
• test-environment/profile test core-sqlite-local --tests io.bookwright.tests.semaphore.AuthenticationLifecycleApiTest
• full test-environment/profile test core-sqlite-local: passed in 3m 2s
• full semaphoreApiCoverage: 61/99 touched, 60/99 successful
• fixture passwords absent from generated Allure and JUnit artifacts