Add sfsr protection and admin pwd change script for powershell

scripts/rotate-admin.ps1

@@ -0,0 +1,37 @@
+$securePassword = Read-Host "Enter new admin password (10+ characters)" -AsSecureString
+$pointer = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($securePassword)
+
+try {
+    $password = [Runtime.InteropServices.Marshal]::PtrToStringBSTR($pointer)
+    if ($password.Length -lt 10) {
+        throw "The new password must have at least 10 characters."
+    }
+
+    $password | docker compose exec -T eternityproject python -c @'
+import sys
+from werkzeug.security import generate_password_hash
+from app import app, get_db
+
+password = sys.stdin.readline().rstrip("\r\n")
+if len(password) < 10:
+    raise SystemExit("The new password must have at least 10 characters.")
+with app.app_context():
+    database = get_db()
+    result = database.execute(
+        "UPDATE users SET password_hash = ?, mfa_secret = NULL, mfa_enabled = 0 WHERE username = 'admin' AND role = 'admin'",
+        (generate_password_hash(password),),
+    )
+    database.commit()
+    if result.rowcount != 1:
+        raise SystemExit("The administrator account was not found.")
+print("ADMIN_PASSWORD_ROTATED_MFA_RESET")
+'@
+    if ($LASTEXITCODE -ne 0) {
+        exit $LASTEXITCODE
+    }
+}
+finally {
+    if ($pointer -ne [IntPtr]::Zero) {
+        [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($pointer)
+    }
+}

scripts/test-smtp.ps1

@@ -0,0 +1,38 @@
+param(
+    [Parameter(Mandatory = $true)]
+    [string]$To
+)
+
+$envFile = Join-Path $PSScriptRoot "..\.env"
+if (-not (Test-Path $envFile)) {
+    throw "Missing .env. Copy .env.example to .env and enter the SMTP settings."
+}
+
+Get-Content $envFile | ForEach-Object {
+    if ($_ -match "^\s*([^#=\s]+)\s*=\s*(.*)\s*$") {
+        [Environment]::SetEnvironmentVariable($matches[1], $matches[2], "Process")
+    }
+}
+
+$required = "MAIL_HOST", "MAIL_PORT", "MAIL_USERNAME", "MAIL_PASSWORD", "MAIL_FROM"
+$missing = $required | Where-Object { [string]::IsNullOrWhiteSpace([Environment]::GetEnvironmentVariable($_, "Process")) }
+if ($missing) {
+    throw "Missing required SMTP settings: $($missing -join ', ')"
+}
+
+$message = [System.Net.Mail.MailMessage]::new($env:MAIL_FROM, $To)
+$message.Subject = "Eternity Project SMTP verification"
+$message.Body = "SMTP delivery verification completed at $(Get-Date -Format o)."
+
+$client = [System.Net.Mail.SmtpClient]::new($env:MAIL_HOST, [int]$env:MAIL_PORT)
+$client.EnableSsl = $true
+$client.Credentials = [System.Net.NetworkCredential]::new($env:MAIL_USERNAME, $env:MAIL_PASSWORD)
+
+try {
+    $client.Send($message)
+    Write-Output "SMTP_TEST_SENT_TO=$To"
+}
+finally {
+    $message.Dispose()
+    $client.Dispose()
+}