backlog: file #1245 -- an admin password reset re-arms bootstrap retirement and disables the account

[wshallwshall]

Files one backlog item. Docs-only: docs/BACKLOG.md, +29 lines, 0 deletions, pure append.

#1245 -- an administrator password reset re-arms bootstrap retirement and disables the account.

The defect

admin_reset_password sets must_change_password=True. That is the same flag
_retire_superseded_bootstrap reads as "the bootstrap is still unclaimed".

So: reset the password of a local account named admin, on a system that has any other enabled
administrator, and the next login attempt disables the account ahead of the credential check. The
temporary credential just issued can never be used. Re-enabling re-triggers it. No route clears the
flag except the self-service change -- which needs the session the reset just revoked.

The recovery route is the destruction route.

Why it survived review

The docstring at auth/service.py:580-581 asserts this cannot happen, and it is right about a
self-service change, which CLEARS the flag. It is wrong about an administrator reset, which SETS
it. The item says so explicitly, because the fix has to correct that sentence and not just the code --
a fix that leaves the docstring standing re-teaches the same wrong model to the next reader.

Scope bound -- please do not lose this if you summarise the item

This is a strong STATIC finding, not a demonstrated one. The chain was read at origin/main with
every line confirmed individually. It has not been reproduced by executing a login sequence, and
the confirming test does not exist. That bound is written into the item body deliberately and should
survive into whatever closes it.

Verification

• exactly one commit e7c16805, matching the filing session's report
• base 2d11dacc is current origin/main -- fresh branch, not stacked on the #1243 head
• carries zero commits belonging to #1243, which is on its own branch and its own PR (backlog: file #1243 -- close ASVS 1.2.2 on the merits, both limbs in one item #364);
  the filing session split them deliberately rather than adding a second unrelated item to an armed PR
• docs-only, +29 -0
• ledger gate passed (1245 allocated via alloc.ps1), leak guard passed
• parse_items: #1245 present, OPEN, exactly one status banner

Severity is written in the conditional per CLAUDE.md section 0.