fix(19): correct admin reset-password client URL (AUTH-LOCAL-08 blocker)

VERIFICATION.md found a cross-layer URL mismatch: fetchAdminResetPassword
POSTed to /api/admin/members/:id/reset-password but the API registers the
route as /api/admin/members/:id/password (admin.ts), so the Admin reset sheet
404'd on every submit. Confirmed live: old path -> 404, correct path -> 400
(route reached). Unit tests missed it because API tests hit the real path
directly and PWA tests mock the fetcher — no test crossed both layers.

Fix the client URL and add a URL-contract regression test that pins the exact
path (asserts fetch is called with /api/admin/members/:id/password).

PWA 266/266 (+1), typecheck clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/pwa/src/api/client.ts

@@ -194,14 +194,15 @@ export async function fetchCreateMember(body: {
 }
 
 /**
- * POST /api/admin/members/:id/reset-password — admin reset of a member's password (Surface 11B).
- * Admin-only; server enforces requireAdmin.
+ * POST /api/admin/members/:id/password — admin reset of a member's password (Surface 11B).
+ * Admin-only; server enforces requireAdmin. (Route is registered as `/members/:id/password`
+ * in apps/api/src/routes/admin.ts — must match exactly or the sheet 404s.)
  */
 export async function fetchAdminResetPassword(
   memberId: number,
   newPassword: string,
 ): Promise<void> {
-  const res = await fetch(`/api/admin/members/${memberId}/reset-password`, {
+  const res = await fetch(`/api/admin/members/${memberId}/password`, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     credentials: 'include',