Changing your own password had one input for it. Nothing can be read back,
and unlike the current password it has never been typed before, so a typo
saves silently and locks you out of an account you could reach a moment
earlier. The only way back is an admin reset.
The admin's reset of someone else's password is untouched: that is the
recovery path, not a self-service change.
Thirty-seven entries in the root, most of them .go files. The assets had to
come along: //go:embed cannot reach outside its own directory, so
templates/, static/ and migrations/ live beside the code that embeds them,
and testdata/ beside the test that reads it. storage/ stays put — runtime
data, not source.
go build now needs -o. Without it the output would be named after the
package directory and collide with src/ itself.
Esa Kataja