fix(auth): make account lockout recoverable and visible

The lockout was checked before the password was verified, so a correct password on a locked
account returned the same generic invalid-credentials error as a wrong one. Users had no way to
tell the two apart, and the natural response was to keep retrying a password that was already
right.

Completing a password reset did not clear the lock either, so the one recovery path the UI
advertises appeared to fail for up to fifteen minutes after a successful reset.

Verify the password first and report the lockout, with the remaining wait, only when the supplied
password was correct. Someone guessing wrong passwords still gets the generic failure, so account
existence is not leaked. Clear the lock whenever a password is reset or changed, and give admins
an explicit unlock action for the case where waiting is not acceptable.

server/test/e2e/authorization-matrix/route-inventory/manifest.json

@@ -1,5 +1,5 @@
 {
-  "totalRoutes": 371,
+  "totalRoutes": 372,
   "byPermission": {
     "(none)": 166,
     "Permission.ManageMetadataConfig": 32,
@@ -8,7 +8,7 @@
     "Permission.BookDockAccess": 17,
     "Permission.ManageAppSettings": 22,
     "Permission.ManageLibraries": 14,
-    "Permission.ManageUsers": 10,
+    "Permission.ManageUsers": 11,
     "Permission.ManageEmail": 8,
     "Permission.KoboSync": 7,
     "Permission.NotificationAccess": 6,