Clearer password recovery and complete account settings

Password recovery and account settings now use one consistent foundation across Booking Bible.

- **The venue-creation error is accurate.** When an imported account exists but has never had a password, the venue wizard now says exactly that. It no longer tells the person that a nonexistent password is wrong.
- **Every password reset uses a code.** Forgot password sends a single-use 6-digit code. The person enters the code and chooses a permanent new password in the same form.
- **Every password change uses a code too.** Being signed in or knowing the current password is not enough to change it. A fresh code is required for staff, clients, venue admins, platform admins, web, and API callers.
- **No password-reset links.** Recovery emails, text messages, imported-client setup messages, admin-assisted resets, compatibility routes, and password-change notices contain no reset link. Older recovery links are redirected to the code flow without being exchanged for a session.
- **Safer password updates.** Codes expire after 10 minutes, can be used once, are stored only as salted hashes, and stop after repeated wrong attempts. Password policy and breach checks run before the code is consumed. A changed password is audited, sends a no-link security notice, and signs out other sessions; re-entering the existing password is an idempotent success using the verified OTP session and emits no change notice.
- **Better staff settings.** Staff can now edit their name and phone, start a code-verified password change, manage personal payment cards, manage notification preferences, and review portable certifications when enabled.
- **Better client settings.** The client profile now puts payment methods and receipts alongside the existing profile, privacy, and account-security tools.
- **Better venue-admin settings.** The admin profile links directly to personal security, the venue plan and invoices, subscription payment cards, and the payment-provider/payout settings used for client payments.
- **Clear billing navigation.** Venue billing now exposes direct shortcuts for payment methods, plan changes, and add-ons.

The existing secure `email_otp_codes` store already supported the required code lifecycle, so this release needs no database migration.