feat: add admin endpoint to reset a user's password

[boludo00]

Summary

• Adds PUT /api/users/{user_id}/password — admin-only endpoint to set a new password for any user
• Applies the same validation as user creation (min 8 chars, max 72 bytes for bcrypt)
• No knowledge of the current password required (admin override)

Test plan

• Admin can reset another user's password and the user can then log in with the new password
• Returns 404 for a non-existent user ID
• Returns 400 for a password shorter than 8 characters
• Returns 400 for a password longer than 72 bytes
• Non-admin users receive 403 when hitting this endpoint