Checkpoint: password reset, rule expiry, migrations

- Self-service and admin password-change endpoints
  (PUT /v1/auth/password, PUT /v1/accounts/{id}/password)
- Policy rule time-scoped expiry (not_before / expires_at)
  with migration 000006 and engine filtering
- golang-migrate integration; embedded SQL migrations
- PolicyRecord fieldalignment lint fix

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

web/templates/fragments/policy_row.html

@@ -4,6 +4,15 @@
   <td class="text-small">{{.Priority}}</td>
   <td>
     <strong>{{.Description}}</strong>
+    {{if .IsExpired}}<span class="badge" style="background:#dc2626;color:#fff;margin-left:.4rem">expired</span>{{end}}
+    {{if .IsPending}}<span class="badge" style="background:#d97706;color:#fff;margin-left:.4rem">scheduled</span>{{end}}
+    {{if or .NotBefore .ExpiresAt}}
+    <div class="text-small text-muted" style="margin-top:.2rem">
+      {{if .NotBefore}}Not before: {{.NotBefore}}{{end}}
+      {{if and .NotBefore .ExpiresAt}} · {{end}}
+      {{if .ExpiresAt}}Expires: {{.ExpiresAt}}{{end}}
+    </div>
+    {{end}}
     <details style="margin-top:.25rem">
       <summary class="text-small text-muted" style="cursor:pointer">Show rule JSON</summary>
       <pre style="font-size:.75rem;background:#f8fafc;padding:.5rem;border-radius:4px;overflow:auto;margin-top:.25rem">{{.RuleJSON}}</pre>