feat(alpha): expose self-hosted reset UI overlay

[JSONbored]

Summary

• Carry the self-hosted admin financial reset UI in the alpha overlay until the pinned upstream image includes the upstream implementation.
• Bump the alpha AIO revision to 0.7.1-alpha.7-aio.8 and keep the stable package untouched.
• Clarify alpha WebAuthn/passkey setup docs and template text.

What changed

• Added alpha overlay files for the reset service, reset job path, Settings -> Self-Hosting Danger Zone UI, reset dialog views, and Security view passkey guidance.
• Added an alpha initializer that wires the reset routes/actions into the pinned upstream app at boot.
• Updated alpha README/docs/changelog/release notes/XML to document the UI plus Rails task.
• Updated alpha asset and runtime tests to prove the overlay files, routes, docs, beta marking, and template surface stay alpha-only.
• Kept reset controls out of Unraid env/template knobs.

Why

• Alpha operators need a visible self-hosted reset path before clean import certification without widening the stable package surface.
• WebAuthn env vars only configure browser trust; passkeys are still added inside Sure after authenticator-app 2FA is enabled.

Screenshots

The alpha overlay carries the same Settings UI as the upstream PR:

Self-Hosting Danger Zone reset entry.	Dry-run review resolved scope and counts before deletion.
Typed confirmation validation before destructive reset.	Reset complete deleted counts and after-state.

Validation

• python -m pytest tests/test_alpha_lane_assets.py
• python -m pytest tests/integration/test_container_runtime.py -k 'test_alpha_image_boots_with_version_import_limits_and_webauthn_env'
• ruby -c rootfs-alpha/rails/app/models/family/financial_data_reset.rb
• ruby -c rootfs-alpha/rails/app/jobs/family_reset_job.rb
• ruby -c rootfs-alpha/rails/lib/tasks/sure_admin.rake
• ruby -c rootfs-alpha/rails/config/initializers/sure_aio_alpha_admin_reset_ui.rb
• git diff --check
• CodeRabbit CLI was run; no security issues were reported.
• Codex Security diff scan: no reportable issues found.

Notes

• Draft stacked PR; base is the alpha preflight/readiness branch.
• The reset UI is intentionally not exposed as an Unraid form/env control.
• This overlay should be removed once the pinned upstream alpha image contains the upstream reset UI.