feat(portal): show one-time Formulus onboarding QR

[najuna-brian]

Summary

• show a one-time Formulus onboarding handoff after admin user creation and password reset, including masked credentials, FRMLS v1 QR, copy controls, and PNG download
• generate strong passwords client-side while allowing admins to reveal, replace, or regenerate them; add confirmation dialogs for password resets and user deletion
• align the Synkronus delete-user route with the OpenAPI-generated portal client while retaining the legacy endpoint

Security

• plaintext credentials remain only in transient React state and are cleared when the onboarding modal is dismissed
• no password or QR payload is persisted in browser storage or returned by a new backend endpoint

Test plan

• Build the portal production bundle with Vite
• Type-check and lint the new portal QR utilities and onboarding component
• Run go test ./internal/api ./internal/handlers
• Create a user and confirm the one-time QR handoff appears
• Reset a user password and confirm the reset warning and QR handoff
• Delete a user through the portal
• Scan the downloaded QR in Formulus on a physical device

Closes #694

[r0ssing]

Looks great! Only comment is about the changes introduced in Synkronus (test + API), which I don't think should be part of this PR? (I can't even see that the new code in the portal even uses that endpoint, but I might've missed that ;-))

[najuna-brian]

Addressed in b483006. I removed the Synkronus API, handler, and test changes. The portal now uses the existing DELETE /api/users/delete/{username} endpoint, so user deletion still works without changing the backend.

[r0ssing]

Looks great! Thanks @najuna-brian !