Password sign-in and lockout

Under Admin › Settings › Authentication › Password sign-in, root chooses who may still sign in with a password:

• Everyone (the default): the sign-in page has the password form, and the providers' buttons under it.
• Root only: the buttons come first, and the password form is behind Use your password (root). Anyone but root who types their password gets the usual "Email or password is wrong", and rmk login with a password answers password_sign_in_disabled and goes on in the browser (Signing in with the browser).

Root only can be chosen only while a provider is on and has passed its test, and asks you to confirm how many people lose their password sign-in. It holds only while a provider is on: with every provider off, everyone may use their password again.

Root can always sign in with a password, whatever is chosen, so a broken provider can't lock everyone out. When a provider breaks or can't be trusted, run disable-sso on the server:

• Docker: docker compose exec web pnpm run disable-sso
• A Linux or macOS service: sudo rmk-server disable-sso
• npm: rmk-server disable-sso; a clone: pnpm run disable-sso

It turns every provider off, and its SCIM, and lets everyone sign in with a password again, after asking (--yes doesn't ask). Nobody is signed out, and the providers keep their settings, links, SCIM tokens and group memberships, to turn back on once fixed. People who sign in only with a provider can't sign in until one is back on, or root sets them a password in Users.

rotate-secret re-encrypts the providers' client secrets with the new AUTH_SECRET, so they keep working; SCIM tokens are kept as hashes, so they aren't affected. revoke-access --everyone revokes the SCIM tokens with everyone's access tokens: generate new ones afterwards. A backup restored with another AUTH_SECRET can't read the client secrets: the provider shows Failing with "Enter the client secret again" (Restoring).