feat: add local user password reset tool

[soulteary]

Summary

• add a disabled-by-default /tool-reset-user-password.php endpoint with a dropdown containing every single-site WordPress user
• accept a confirmed new account password and update/verify it in one SQLite transaction
• add independent WORDPRESS_USER_PASSWORD_RESET_* enable and credential variables, Docker secret resolution, persistent throttling, concurrent-operation exclusion, and one-shot locking
• reconcile the endpoint into existing document-root volumes and safely clear only its own state during a disabled start
• add unit, entrypoint, and built-image smoke coverage plus README, security, release, and Compose documentation

Security behavior

• returns 404 unless the exact enable switch and one valid credential source are configured
• globally locks for 15 minutes after five invalid recovery credentials
• consumes authorization before the database write and remains closed across workers/restarts
• displays login/display names only; it does not expose email addresses or password hashes
• intentionally rejects Multisite

Verification

• ShellCheck, PHP lint, actionlint, and all repository tests
• amd64 image smoke with the native parser
• arm64 image smoke with the native parser
• arm/v7 image smoke with the pure-PHP parser fallback
• each image smoke creates a user, resets its password, verifies the new password, rejects the old password, and confirms the endpoint's one-shot lock

CI run: https://github.com/soulteary/docker-sqlite-wordpress/actions/runs/33535726428

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-01T17:08:15.669056Z	74de08f	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.