feat: skip password prompts for W3DS-logged sessions

[kulmin]

Closes #13.

Summary

W3DS sessions now skip Nextcloud's password-confirmation prompt entirely (server-side middleware + client-side modal), and the mandatory post-login password-setup screen is gone.

AuthController::completeLogin() stamps IToken::SCOPE_SKIP_PASSWORD_VALIDATION and IToken::SCOPE_FILESYSTEM on the session token right after createSessionToken(), mirroring how core handles SSO logins in OC_User::loginWithApache(). The middleware reads the scope and returns early; JSConfigHelper::canUserValidatePassword() reads the same scope and emits window.backendAllowsPasswordConfirmation = false, which makes @nextcloud/password-confirmation short-circuit before the modal can spawn.

The whole password-setup pathway (PasswordSetupController, password-setup.php template, password-gate.js, the redirect gate in BeforeTemplateRenderedListener, the two routes) is removed. The provisioning marker is renamed must_set_password -> provisioned and the orphan-sweep in DedupeMappingsCommand::sweepOrphans() follows it. A postSchemaChange migration renames any existing rows in oc_preferences.

min-version bumped to 30 (where the scope constants land). App version bumped to 0.7.0.

Why

W3DS users authenticate cryptographically; they have no password to confirm. The previous workaround (force every new user to invent a password they would never use) was the wrong shape and contradicted the passwordless premise the app advertises.

Test plan

• New W3DS user logs in via QR, lands on / directly, no password-setup intermediate page
• Personal → Security → "Create new app password" creates a token without showing the sudo-mode modal
• Personal → change email address does not show the modal
• Browser console reports window.backendAllowsPasswordConfirmation === false for a W3DS session
• Existing W3DS user with must_set_password='1' in oc_preferences: after migration, row is provisioned='1' and they log straight into /
• Regular admin (non-W3DS) still sees the modal on security actions (bypass is per-session)
• occ w3ds_login:dedupe-mappings --dry-run still detects orphan provisioned-but-unmapped users after the rename