Fix player getAccount has_password: read the raw row, not sanitized req.user

req.user comes from getById which strips password_hash, so has_password was
always false — the account page mis-rendered a real password account as the
SSO-only 'set a password' variant (and the change-password form omitted the
required current-password field). Read the raw row for that one flag.

Caught by a browser click-through of the /account portal. Adds a regression
test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019rao86n5cXpwAyjdBFEshV

server/src/router/v1/admin/account.controller.js

@@ -16,17 +16,24 @@ const log = require('../../../utils/logger')('account')
 
 // Current user's security status (does not expose the secret). has_password lets
 // the player portal tell an SSO-only account (must *set* a password, no current
-// one required) apart from one that already has a usable password.
+// one required) apart from one that already has a usable password. req.user is the
+// sanitized row (password_hash stripped), so read the raw row for that one flag.
 async function getAccount(req, res) {
-  return res.json({
-    id: req.user.id,
-    username: req.user.username,
-    role: req.user.role,
-    email: req.user.email || null,
-    status: req.user.status || 'active',
-    totp_enabled: Boolean(req.user.totp_enabled),
-    has_password: Boolean(req.user.password_hash),
-  })
+  try {
+    const raw = await users.getRawById(req.user.id)
+    return res.json({
+      id: req.user.id,
+      username: req.user.username,
+      role: req.user.role,
+      email: req.user.email || null,
+      status: req.user.status || 'active',
+      totp_enabled: Boolean(req.user.totp_enabled),
+      has_password: Boolean(raw && raw.password_hash),
+    })
+  } catch (err) {
+    log.error('getAccount', err)
+    return res.status(500).json({ message: 'Internal Server Error' })
+  }
 }
 
 // Re-mint this caller's session and refresh their cookie so a self-service change