tracker: add -changepw to change a user passphrase

Mirrors -adduser: prompts for a new passphrase (min 8 chars) or reads
TRACKER_PASSWORD, hashes with bcrypt, and updates the stored hash.
Returns an error if the user does not exist.

internal/store/auth.go

@@ -46,6 +46,14 @@ func (s *Store) UserByName(username string) (User, error) {
 	return u, err
 }
 
+func (s *Store) SetPassword(username, passwordHash string) error {
+	res, err := s.db.Exec(`UPDATE users SET password_hash = ? WHERE username = ?`, passwordHash, username)
+	if err != nil {
+		return err
+	}
+	return checkAffected(res)
+}
+
 // --- api keys ---
 
 func (s *Store) CreateAPIKey(name, keyHash string) (int64, error) {