chore(ci): add guard against password handlers that skip base64-decode (regression class of #356)

[cristim]

PR #357 (closed #356, P0) fixed a bug where the resetPassword API handler forgot to base64-decode new_password, locking out invited users. PR #357 noted that a CI guard against this class of bug (a handler that accepts a password but skips the decode step) was deferred as a follow-up, but no issue was filed.

Scope:

• Add a CI / lint guard (or a focused test) that catches handlers which read a password field but skip the expected base64-decode step, so the fix(auth/api): password-reset endpoint forgets to base64-decode new_password — invited users locked out #356 regression class cannot silently reappear.

Out of scope when deferred: PR #357 was a targeted P0 fix; the systemic guard is a separate, lower-priority hardening item.

Deferred by: #357
Related: #356 (the original bug, fixed).

[cristim]

Verified shipped on feat/multicloud-web-frontend via PR #722 (merged 2026-05-27). AST-based CI scanner (TestBase64PasswordGuard) now fails the build if any handler that json-unmarshals a request body and reads a .Password field does not call decodeBase64Password.