fix: restore mandatory default admin password change

[RussH]

Summary

Restore the mandatory password-change flow when the default admin / cats credentials are used.

This is a compatibility-focused fix for the regression identified in #868. It keeps the existing fresh-install credentials for now, but prevents them from remaining usable after the administrator's first login.

Changes

• restore the server-side redirect to m=settings&a=newInstallPassword when admin / cats is used
• remove the legacy browser-side defaultLogin() auto-login behaviour
• stop the installer redirecting through ?defaultlogin=true
• return users to the normal login page after installation
• clarify that the initial cats password is temporary
• add CSRF tokens to the existing initial-configuration POST forms
• reuse the existing Users::resetPassword() path for the password change
• add Behat coverage for the forced password-change flow
• use a deterministic non-default administrator password for other Behat scenarios

Rationale

The older JavaScript first-login wizard remains disabled. Restoring it would reintroduce legacy JavaScript and duplicate password-change behaviour which is already available through the existing server-side newInstallPassword flow.

This deliberately avoids changing the schema, password hashing implementation, upgrade behaviour or existing installation credentials.

Testing

• test/features/login.feature: 7/7 scenarios pass
• dedicated default-password scenario: 14/14 steps pass
• full Behat run: 1,434 passed, 7 failed
• isolated security suite reproduces the same 7 failures in moduleSubPagesSecurity.feature
• those failures relate to the existing Candidate Show showHideSingleQuickActionMenu assertion; none of the affected candidate/security files differ from master

Security note

Fresh installations still initially use the known admin / cats credentials, so there remains a window between installation and the legitimate administrator's first login.

This change restores the historical mandatory first-login password change as a low-risk compatibility fix. A future installer change can eliminate the shared initial credential entirely.

Refs #868