feat(alpha): expose self-hosted reset UI overlay

[JSONbored]

Summary

• Carry the self-hosted financial reset UI in the alpha overlay after the preflight overlay landed.
• Keep the stable package untouched and keep the reset controls alpha-only.
• Clarify the alpha WebAuthn/passkey setup text.

What changed

• Added alpha overlay files for the reset service, reset job path, Settings self-hosting danger-zone UI, reset dialog views, and Security view passkey guidance.
• Added an alpha initializer that wires the reset routes/actions into the pinned upstream app at boot.
• Updated alpha README/docs/changelog/release notes/XML for the reset UI and Rails task.
• Updated alpha asset and runtime tests for overlay files, routes, docs, beta marking, and template surface.

Why

• Alpha operators need a visible self-hosted reset path before clean import certification without widening the stable package surface.
• WebAuthn env vars only configure browser trust; passkeys are still added inside Sure after authenticator-app 2FA is enabled.

Validation

• python -m pytest tests/test_alpha_lane_assets.py -q
• ruby -c rootfs-alpha/rails/app/models/family/financial_data_reset.rb
• ruby -c rootfs-alpha/rails/app/jobs/family_reset_job.rb
• ruby -c rootfs-alpha/rails/config/initializers/sure_aio_alpha_admin_reset_ui.rb
• Central aio-fleet control-check passed locally for the rebased branch: repo/caller policy, integration runtime tests, and Trunk.

Notes

• Replaces closed stacked PR feat(alpha): expose self-hosted reset UI overlay #108, which auto-closed when its temporary base branch was deleted after feat(imports): add alpha Sure preflight overlay #107 merged.
• This overlay should be removed once the pinned upstream alpha image contains the upstream reset UI.