feat(settings): password change, 2FA enable/disable, API-key UI + Swagger; fix Owner RBAC drift

Settings was missing self-service account security and any API-key UI:
- Account security (new Security tab): change password (POST /auth/change-password
  — verifies current via Argon2, rejects unchanged), enable 2FA (wires the
  existing /auth/2fa/setup QR + /auth/2fa/verify), and disable 2FA (new
  POST /auth/2fa/disable, requires a current code so a hijacked session can't
  strip the second factor).
- New API tab: create/list/revoke per-license API keys (the overnight backend
  had no UI), plaintext shown once, plus an 'API docs' button to /api/docs (Swagger).

Root-cause RBAC fix — the system-default Owner role enumerated per-resource
wildcards (server.*, wipe.*, ...) and drifted: apikeys, webhooks, alerts,
analytics, chat, schedules, notifications, map, users and ALL plugin-config
modules (plus singular plugin.* vs granted plugins.*) were locked out for any
non-super-admin Owner. Owner = full control of its license:
- migration 025 sets the Owner role to {"*": true}
- PermissionsGuard honors '*' as allow-all
- frontend hasPermission honors '*' and resource.* wildcards (was exact-match
  only, so wildcard-based roles silently failed)

Backend tsc + frontend build green. NOTE: migration 025 auto-applies on a fresh
DB (Saturday); the live DB needs the one-line UPDATE applied to unlock the API
tab for a non-super-admin owner.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/stores/auth.ts

@@ -97,7 +97,12 @@ export const useAuthStore = defineStore('auth', () => {
         ? decodeJwtPermissions(accessToken.value)
         : {}
 
-    return perms[permission] === true
+    // Honor the global wildcard (Owner) and resource wildcards ("server.*")
+    // so role permissions stored as wildcards aren't missed by an exact match.
+    if (perms['*'] === true) return true
+    if (perms[permission] === true) return true
+    const resourceWildcard = permission.split('.')[0] + '.*'
+    return perms[resourceWildcard] === true
   }
 
   return {