feat: open the last locked fields for editing, keeping their history intact

Four fields were still frozen because changing them would have bypassed the
record that makes the change traceable, and a user's login data could not be
corrected at all. Locking a field is the wrong trade: a wrong value stays in
the system forever. The fix is to let the edit write the same history entry the
dedicated endpoint writes.

- A colony's apiary is editable through PATCH and writes the same
  ColonyApiaryHistory entry POST /colonies/:id/move writes, so the location
  history never skips a stand the colony was recorded on.
- A honey batch's storage container is editable through PATCH and writes the
  same HoneyBatchRelocation entry POST /honey-batches/:id/relocate writes.
- A stock item's quantity is editable and books the difference as an ADJUSTMENT
  movement, so the stored level stays the sum of its movements.
- A role's key is editable (system roles were already rejected outright by
  RolesService.update, which keeps the seed's ADMIN lookup intact).
- A user's e-mail - the login identity - is editable. A typo there previously
  locked the account out for good.
- New POST /users/:id/reset-password lets an administrator set someone else's
  password: there is no self-service reset flow, so a forgotten password was
  the one thing no edit could repair. It revokes every refresh token and clears
  the permission cache exactly as a self-service change does, refuses to act on
  your own account (that goes through /profile/password, which proves ownership
  by asking for the current one), and never writes the password to the log.

Frontend:
- Users had no edit UI at all, although PATCH /users/:id existed. New
  EditUserDialog covers name, e-mail, role and an optional new password.
- Colony, honey batch and stock item forms gained the newly editable fields,
  each with a note saying the correction is recorded as a move, a relocation
  or a stock adjustment.
- The role dialog gained the key field.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

ApiCore-Backend/src/users/users.service.spec.ts

@@ -21,6 +21,7 @@ describe('UsersService', () => {
     role: {
       findUnique: jest.Mock;
     };
+    refreshToken: { updateMany: jest.Mock };
   };
   let auditLog: { record: jest.Mock };
   let permissionResolver: {
@@ -77,6 +78,7 @@ describe('UsersService', () => {
       role: {
         findUnique: jest.fn().mockResolvedValue(staffRole),
       },
+      refreshToken: { updateMany: jest.fn() },
     };
     auditLog = { record: jest.fn().mockResolvedValue(undefined) };
     permissionResolver = {
@@ -379,4 +381,53 @@ describe('UsersService', () => {
     ).rejects.toBeInstanceOf(ForbiddenException);
     expect(prisma.user.update).not.toHaveBeenCalled();
   });
+
+  describe('resetPassword', () => {
+    it('revokes every refresh token and clears the permission cache', async () => {
+      prisma.user.findUnique.mockResolvedValue(existingUser);
+      prisma.user.update.mockResolvedValue(existingUser);
+
+      await usersService.resetPassword(
+        'user-1',
+        { password: 'neuesPasswort1' },
+        'user-admin',
+      );
+
+      expect(prisma.refreshToken.updateMany).toHaveBeenCalledWith({
+        where: { userId: 'user-1', revokedAt: null },
+        data: { revokedAt: expect.any(Date) as Date },
+      });
+      expect(permissionResolver.invalidateUser).toHaveBeenCalledWith('user-1');
+    });
+
+    it('stores a hash, never the password itself', async () => {
+      prisma.user.findUnique.mockResolvedValue(existingUser);
+      prisma.user.update.mockResolvedValue(existingUser);
+
+      await usersService.resetPassword(
+        'user-1',
+        { password: 'neuesPasswort1' },
+        'user-admin',
+      );
+
+      const [[updateArgs]] = prisma.user.update.mock.calls as [
+        [{ data: { passwordHash: string } }],
+      ];
+      expect(updateArgs.data.passwordHash).not.toBe('neuesPasswort1');
+      expect(updateArgs.data.passwordHash).toMatch(/^\$2[aby]\$/);
+    });
+
+    it('refuses to reset your own password, which belongs to /profile/password', async () => {
+      prisma.user.findUnique.mockResolvedValue(existingUser);
+
+      await expect(
+        usersService.resetPassword(
+          'user-1',
+          { password: 'neuesPasswort1' },
+          'user-1',
+        ),
+      ).rejects.toBeInstanceOf(ForbiddenException);
+      expect(prisma.user.update).not.toHaveBeenCalled();
+    });
+  });
 });