refactor(api): drop dead password-era ResetMailer, reconcile passkey-unbind docs

The passwordless migration left ResetMailer (SendPasswordReset) and its API field with zero callers and no wiring; the web console authenticates via email-OTP and passkey only. Remove both, plus the now-orphaned context import that the interface was the last user of in handlers_users.go.

Reconcile the DeleteAllPasskeyCredentialsForUser docs in repo.go and pgrepo.go: they claimed there was no production caller, but 2f22027 wired the owner-tier DELETE /users/{id}/passkeys. Both now note that a complete authenticator remediation pairs the unbind with a session revoke (unbinding alone leaves the live hijacked session; revoking alone leaves a re-enrollable credential), and the OpenAPI operation carries the same guidance in a new description. Reword the stale local-password test-fake header, since the passwordless fakes carry no must_change_password field.

No behavior change. gofmt, build, and the full test tree are green; OpenAPI parity and passkey-unbind tests pass; a grep confirms ResetMailer/SendPasswordReset are gone from the Go tree.

internal/api/api.go

@@ -73,11 +73,6 @@ type API struct {
 	// sender. The code is never returned to the client on either path.
 	Mailer OTPMailer
 
-	// ResetMailer delivers admin-generated password-reset passwords to the user's
-	// verified email address. Same nil→server-side-log pattern as Mailer; the
-	// password is never returned to the admin caller. Production wires a real sender.
-	ResetMailer ResetMailer
-
 	// Passkey verifies WebAuthn credential-creation ceremonies (spec §14 / Phase 6
 	// passkey bind). It is optional: when nil the passkey register routes report 503
 	// rather than panic, so the authenticated enrollment boundary is exercised before