Fix player getAccount has_password: read the raw row, not sanitized req.user

req.user comes from getById which strips password_hash, so has_password was
always false — the account page mis-rendered a real password account as the
SSO-only 'set a password' variant (and the change-password form omitted the
required current-password field). Read the raw row for that one flag.

Caught by a browser click-through of the /account portal. Adds a regression
test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019rao86n5cXpwAyjdBFEshV

server/test/playerAccounts.test.js

@@ -8,6 +8,7 @@ const assert = require('node:assert/strict')
 const bcrypt = require('bcryptjs')
 
 const authCtrl = require('../src/router/v1/auth/auth.controller')
+const account = require('../src/router/v1/admin/account.controller')
 const users = require('../src/model/users/users.model')
 const settings = require('../src/model/settings/settings.model')
 const botScore = require('../src/middleware/botScore')
@@ -73,6 +74,28 @@ test('isDuplicateUsername recognizes the driver duplicate-key error', () => {
   assert.equal(users.isDuplicateUsername(null), false)
 })
 
+// ── getAccount.has_password reads the RAW row ─────────────────────────────
+// Regression: req.user is the sanitized row (password_hash stripped), so
+// has_password must come from users.getRawById, not req.user.password_hash —
+// otherwise a real password account is mis-rendered as "set a password".
+test('getAccount reports has_password from the raw row, not the sanitized req.user', async () => {
+  const origGetRaw = users.getRawById
+  try {
+    users.getRawById = async () => ({ id: 1, password_hash: '$2a$hash' }) // has a password
+    const req = { user: { id: 1, username: 'p', role: 'player', status: 'active', totp_enabled: 0 } } // sanitized: no hash
+    const res = mockRes()
+    await account.getAccount(req, res)
+    assert.equal(res.body.has_password, true)
+
+    users.getRawById = async () => ({ id: 1, password_hash: null }) // SSO-only, no password
+    const res2 = mockRes()
+    await account.getAccount(req, res2)
+    assert.equal(res2.body.has_password, false)
+  } finally {
+    users.getRawById = origGetRaw
+  }
+})
+
 // ── Registration honeypot (does not need the DB) ──────────────────────────
 test('register with a filled honeypot fails and bans the IP before any DB hit', async () => {
   const ip = '203.0.113.90'