feat(19-04): AdminPage LOCAL ACCOUNTS + SettingsSheet change-password / link-OIDC

- Add hasLocalCredential to AdminMember type (mirrors API extension from plan 19-02)
- Add createMember mutation + Surface 11A inline add-member form in AdminPage
- Add Surface 11B Reset-password button in MemberRow (hasLocalCredential gate)
- Add ResetPasswordSheet component (bottom-sheet, role=dialog, focus-managed, Escape closes)
- Add Surface 12 Change-password row in SettingsSheet (hasLocalCredential gate)
- Add Surface 13 Link-OIDC identity row in SettingsSheet (hasLocalCredential + oidcEnabled gate)
- Add ChangePasswordSheet component (current/new/confirm fields, change-password mutation)
- Add LinkOidcSheet component (confirmation dialog; uses generic OIDC copy per D-06, no provider branding)
- Fix: update InstructionSheet.test.tsx to wrap with QueryClientProvider (Rule 1 - now uses useQuery)
- Fix: remove stale eslint-disable in App.test.tsx (lint --max-warnings 0 would fail)
- All 263 tests pass; typecheck clean; lint clean

apps/pwa/src/App.test.tsx

@@ -125,7 +125,7 @@ function renderApp(queryClient: QueryClient) {
 
 const mockFetchSetupStatus = fetchSetupStatus as Mock;
 const mockFetchMe = fetchMe as Mock;
-const _mockFetchAuthMode = fetchAuthMode as Mock; // eslint-disable-line @typescript-eslint/no-unused-vars
+const _mockFetchAuthMode = fetchAuthMode as Mock;
 
 // ── Tests ─────────────────────────────────────────────────────────────────────