feat: Phase 1 - user/password API extensions and auth route fix

crates/pm-core/src/lib.rs

@@ -13,7 +13,8 @@ pub use crypto::{decrypt, encrypt, load_or_create_key, CryptoError, KEY_PATH};
 pub use error::{AppError, ErrorResponse};
 pub use models::{
     AuthProvider, CreateGroupRequest, CreateHealthCheckRequest, CreateHostRequest,
-    CreateUserRequest, DiscoveryCidrRequest, DiscoveryResult, Group, HealthCheck,
+    ChangePasswordRequest, AdminResetPasswordRequest, CreateUserRequest,
+    DiscoveryCidrRequest, DiscoveryResult, Group, HealthCheck,
     HealthCheckResult, HealthCheckWithResult, Host, HostHealthStatus, HostSummary,
     RegisterDiscoveredRequest, UpdateGroupRequest, UpdateHealthCheckRequest, UpdateUserRequest,
     User, UserRole as DbUserRole,

crates/pm-core/src/models.rs

@@ -251,6 +251,22 @@ pub struct UpdateUserRequest {
     pub email: Option<String>,
     pub role: Option<String>,
     pub is_active: Option<bool>,
+    pub force_password_reset: Option<bool>,
+}
+
+/// Self-service password change payload
+#[derive(Debug, Deserialize)]
+pub struct ChangePasswordRequest {
+    pub current_password: String,
+    pub new_password: String,
+}
+
+/// Admin password reset payload
+#[derive(Debug, Deserialize)]
+pub struct AdminResetPasswordRequest {
+    pub new_password: String,
+    #[serde(default)]
+    pub force_password_reset: bool,
 }
 
 // ============================================================