feat: add forced password change page on first login

The backend sets mustChangePassword=true for all new accounts and
blocks API calls until the password is changed. The frontend was not
handling this flag - it logged the user in and redirected to the
dashboard where every API call silently failed with 403.

Add a /change-password page that is shown when mustChangePassword is
true. The login page now redirects there instead of home, and the
AuthGuard intercepts any direct navigation to force the change first.

apps/web/src/pages/login-page.tsx

@@ -26,8 +26,12 @@ export function LoginPage() {
       setToken(data.token);
       // Store username for settings display
       localStorage.setItem("stirling-username", data.user?.username || username);
-      // Full reload to force auth re-check (useAuth runs on mount)
-      window.location.href = "/";
+      // Redirect to password change if required, otherwise go home
+      if (data.user?.mustChangePassword) {
+        window.location.href = "/change-password";
+      } else {
+        window.location.href = "/";
+      }
     } catch {
       setError("Connection error");
     } finally {