feat: allow admins to change user passwords

src/app/admin/page.tsx

@@ -1789,6 +1789,7 @@ function UsersSection({ onToast }: { onToast: (msg: string, type: string) => voi
             <div style={{ display: 'grid', gap: 12 }}>
               <I label="First Name" value={editing.first_name || ''} onChange={(v: string) => setEditing({ ...editing, first_name: v })} />
               <I label="Last Name" value={editing.last_name || ''} onChange={(v: string) => setEditing({ ...editing, last_name: v })} />
+              <I label="New Password (leave blank to keep current)" type="password" value={editing.password || ''} onChange={(v: string) => setEditing({ ...editing, password: v })} placeholder="Enter new password to change" />
               <div style={{ display: 'flex', alignItems: 'center', gap: 8 }}>
                 <input type="checkbox" checked={editing.comments_disabled || false} onChange={(e) => setEditing({ ...editing, comments_disabled: e.target.checked })} />
                 <label style={{ fontSize: 13, color: C.text }}>Disable comments</label>

src/app/api/admin/users/route.ts

@@ -37,7 +37,21 @@ export async function PUT(request: NextRequest) {
   try {
     await requireRole('admin');
     const body = await request.json();
-    const { id, first_name, last_name, comments_disabled } = body;
+    const { id, first_name, last_name, comments_disabled, password } = body;
+
+    // If password provided, hash and update it too
+    if (password) {
+      const { hashPassword } = await import('@/lib/auth');
+      const hash = await hashPassword(password);
+      const { rows } = await db.query(
+        'UPDATE users SET first_name = $1, last_name = $2, comments_disabled = $3, password_hash = $4 WHERE id = $5 RETURNING id, username, role, first_name, last_name, comments_disabled, created_at',
+        [first_name || null, last_name || null, comments_disabled === true, hash, id]
+      );
+      if (rows.length === 0) {
+        return NextResponse.json({ error: 'User not found' }, { status: 404 });
+      }
+      return NextResponse.json({ data: rows[0] });
+    }
 
     const { rows } = await db.query(
       'UPDATE users SET first_name = $1, last_name = $2, comments_disabled = $3 WHERE id = $4 RETURNING id, username, role, first_name, last_name, comments_disabled, created_at',