Portal sign-in with the Ecare office login

Ecare staff sign in with their office username and password, checked by
the Ecare sign-in service from the backend (AUTH_TOKEN_API_URL); a good
Ecare login still needs a Portal User. Service down = "try again
shortly", never a wrong password. /api/auth/login, me, logout; sign-in
tries limited per address. Users page: Ecare office login or Portal
password per user. Context.md: 27/10 runs, the login retry bug.
71 test files, 1239 tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/templates/password.html

@@ -8,6 +8,11 @@
 {% block content %}
 <div class="pw">
   <h1>Change password</h1>
+  {% if user.ecare %}
+  <p class="sub">You sign in with your Ecare office login, so this Portal
+    keeps no password for you. Your password is your Ecare office password —
+    change it in Ecare.</p>
+  {% else %}
   {% if user.must_change %}<p class="sub">Choose your own password before
     going on (an Admin set the one you signed in with).</p>
   {% else %}<p class="sub">At least 10 characters, not your username.</p>{% endif %}
@@ -19,5 +24,6 @@
     <label>New password again <input name="confirm" type="password" autocomplete="new-password" minlength="10" required></label>
     <button type="submit">Change password</button>
   </form>
+  {% endif %}
 </div>
 {% endblock %}