sec(auth): API-key revocation durability, role_arn host-identity check, openapi base64 note (follow-ups to #392/#393/#396) #402

Follow-ups from the reviews of #392, #393 and #396

1. (sec(auth): close API-key persistence primitive on password rotation (#102) #392) internal/auth/service_password.go:221-227 invalidateUserCredentialsBestEffort: API-key revocation on password rotation is best-effort. If ListAPIKeysByUser/UpdateAPIKey fails, the password change reports success and the key survives with only a warning log. Make it fail loud, or better, fix item 2.
2. (sec(auth): close API-key persistence primitive on password rotation (#102) #392) Validation-time closure: record password_changed_at on the user, and have ValidateUserAPIKey reject keys whose CreatedAt predates it. This closes the list-then-update race (a caller who knows the current password can mint a key between the hash write and the revocation scan), and it also neutralizes legacy keys minted with nil ExpiresAt at the owner's next rotation, without a store scan.
3. (sec(scheduler): fail loud on an empty AWS role ARN unless auth mode is role_arn #396) internal/scheduler/scheduler.go:764 ambient branch: an operator who explicitly picks role_arn on a non-host account and omits the ARN still gets host-credential collection tagged with that account's UUID. When acct.ExternalID != "", resolve sts:GetCallerIdentity and refuse if the account number differs from ExternalID, and/or have validateAWSAuthMode (handler_accounts.go:412-428) require aws_role_arn for role_arn unless external_id matches the host identity. The same check belongs in credentials/resolver.go:175 (A03-012).
4. (fix(auth): decode the base64-encoded password in setupAdmin #393) internal/api/openapi.yaml: document that setup-admin's (and login's) password is base64-encoded.

Each item needs a regression test that fails before the fix.