Manage the password in the app; close remaining audit findings

Password management moves out of the CLI entirely. The credential is now a
salted scrypt hash in the database (so it survives rebuilds, living in the /data
volume) rather than an environment variable; PARTS_PASSWORD is demoted to a
bootstrap value that stops working the moment a password is set in the UI. Every
token carries a session epoch, so changing the password — or "sign out other
devices" — invalidates outstanding cookies while keeping the browser that made
the change signed in. A banner nags until the handed-over password is replaced.
app/admin.py remains for the one case the UI cannot cover, a forgotten password.

Audit findings:
- Taxonomy update and delete scanned affected parts before taking the write
  lock, so a concurrent rename could leave the search index matching a name the
  UI no longer showed. All four routes now lock first; removing the lock again
  makes the new test fail exactly that way.
- History of a missing part returned 200 with an empty list; now 404.
- Infinity and NaN passed ge=0 and failed at the database. They are rejected as
  422 now, and the validation error handler no longer chokes trying to echo a
  non-finite value back.

Checks go from 134 to 181.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

static/index.html

@@ -27,10 +27,15 @@
     <span class="stat" id="stats"></span>
     <button class="ghost small mobile-only" id="filters-btn">Filters</button>
     <button class="primary" id="add-btn">+ Add</button>
-    <button class="ghost small" id="manage-btn" title="Categories &amp; locations">⚙</button>
+    <button class="ghost small" id="manage-btn" title="Settings">⚙</button>
     <button class="ghost small hidden" id="logout-btn" title="Log out">⏻</button>
   </header>
 
+  <div id="bootstrap-banner" class="banner hidden">
+    <span>You're still using the password that was handed to you. Set your own.</span>
+    <button class="small primary" id="banner-change">Change password</button>
+  </div>
+
   <div class="layout">
     <aside id="sidebar">
       <h3>Filters</h3>