chore: import DH V2 D5.6.4 production baseline

api-v3/test/unit/phase-d5-6-1-user-password-reset.test.ts

@@ -0,0 +1,27 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import test from 'node:test';
+
+const root = process.cwd();
+const read = (relative: string) => fs.readFileSync(path.join(root, relative), 'utf8');
+
+test('D5.6.1 exposes controlled administrative password reset with the existing user-update permission', () => {
+  const controller = read('src/administration/users/users.controller.ts');
+  const dto = read('src/administration/users/dto/reset-user-password.dto.ts');
+  assert.match(controller, /@Post\(':id\/reset-password'\)/);
+  assert.match(controller, /@RequirePermissions\('users.update'\)/);
+  assert.match(dto, /@MinLength\(12\)/);
+  assert.match(dto, /mustChangePassword = true/);
+});
+
+test('D5.6.1 resets lockout revokes sessions and audits without persisting the password value', () => {
+  const service = read('src/administration/users/users.service.ts');
+  const audit = read('src/database/entities/audit-event.entity.ts');
+  assert.match(service, /user\.failedLoginAttempts = 0/);
+  assert.match(service, /user\.lockedUntil = null/);
+  assert.match(service, /revokeUserSessions\(id, undefined, manager\)/);
+  assert.match(service, /AuditAction\.USER_PASSWORD_RESET/);
+  assert.match(service, /passwordValueRecorded: false/);
+  assert.match(audit, /USER_PASSWORD_RESET = 'USER_PASSWORD_RESET'/);
+});