Add bin/pip-reset-admin.sh to reset the bootstrap admin password

Operators who lose the bootstrap password, or want to rotate it
after first sign-in, can now run:

    sudo bash bin/pip-reset-admin.sh             # interactive
    sudo bash bin/pip-reset-admin.sh --generate
    sudo bash bin/pip-reset-admin.sh --password '<value>'

The script:
- Hashes the new password via the running backend container's
  bcryptjs (cost 12, identical to the application path).
- UPDATEs users.password_hash for BOOTSTRAP_ADMIN_EMAIL, clears any
  pending password-reset token, and re-activates the row if it was
  marked disabled.
- Errors out if exactly 1 row wasn't updated, so a typo in the
  email or a missing user fails loudly.
- Writes a user.password.reset audit event.
- Mirrors the new value into ${DATA_ROOT}/secrets-backup.txt and
  .env.compose so installer reruns stay consistent.

Also added a [p] entry to the interactive menu in pip-status.sh so
the same flow is one keypress away from the status screen.