Add passwd command, fix template rendering, update deployment docs

- Add `passwd` CLI command to reset user passwords
- Fix web UI templates: parse each page template with layout so blocks
  render correctly (was outputting empty pages)
- Add login error logging for debugging auth failures
- Update README with deploy workflow and container management commands
- Update RUNBOOK for Docker-on-deimos deployment (replaces systemd refs)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -49,7 +49,8 @@ eng-pad-server/
 │   └── eng-pad-server/              CLI entry point (cobra)
 │       ├── main.go
 │       ├── server.go                server subcommand
-│       └── init.go                  init subcommand
+│       ├── init.go                  init subcommand
+│       └── passwd.go               password reset subcommand
 ├── internal/
 │   ├── auth/
 │   │   ├── argon2.go                Password hashing