feat: warn on /account.html when password is still default

[melvincarvalho]

Summary

Adds a red warning banner above the Password section on /account.html when the user is still on rung 1 (default `me`/`me`). Auto-detected via a server-side probe — no localStorage state to go stale.

How the probe works

On page load (signed-in branch), `/account.html` sends:

```http
PUT /idp/credentials
{"currentPassword":"me","newPassword":"me"}
```

…via `session.authFetch` (DPoP-bound). JSS's behaviour:

• 204 → current password really is `me` → password is still default → show the banner
• 401 → current password is something else → password has been changed → no banner

The side effect when default is a bcrypt re-hash of the same value. JSS rate-limits to 10/min per IP, so no abuse risk.

Banner UX

• Red palette (#fff0f0 bg, #a00 text)
• Text: "You're using the default password. Change it below to claim your pod."
• Disappears synchronously after a successful change (no reload)
• Stays gone after subsequent loads (probe returns 401)

Test plan

• Fresh pod-data, sign in with me/me → banner appears above password form
• Change password to anything else → banner hides instantly
• Refresh /account.html → banner stays hidden (probe sees 401)
• Console clean except favicon 401

What's not in this PR (next thing)

Welcome.html tiles still don't unlock after sign-in — they use plain `fetch` for the HEAD probe and miss the OIDC token. That's a separate ~30-line PR adding solid-oidc to welcome.html.

Refs #1 #6