fix(shadcn): isolate Nexus CSS vars with --nx- prefix + admin password reset endpoint

backend/Services/AuthService.cs

@@ -17,6 +17,7 @@ public interface IAuthService
     Task<NexusUser?> GetUserAsync(Guid userId, CancellationToken ct = default);
     Task<NexusUser?> UpdateProfileAsync(Guid userId, UpdateProfileRequest request, CancellationToken ct = default);
     Task<bool> ChangePasswordAsync(Guid userId, ChangePasswordRequest request, CancellationToken ct = default);
+    Task<bool> AdminResetPasswordAsync(string email, string newPassword, string adminToken, CancellationToken ct = default);
 }
 
 public sealed record AuthSession(
@@ -31,6 +32,8 @@ public sealed class AuthService : IAuthService
     private readonly IConfiguration _config;
     private readonly ILogger<AuthService> _logger;
 
+    private static string AdminResetToken => Environment.GetEnvironmentVariable("Admin__ResetToken") ?? string.Empty;
+
     public AuthService(IUserRepository users, IConfiguration config, ILogger<AuthService> logger)
     {
         _users = users;
@@ -128,6 +131,46 @@ public sealed class AuthService : IAuthService
         return true;
     }
 
+    public async Task<bool> AdminResetPasswordAsync(string email, string newPassword, string adminToken, CancellationToken ct = default)
+    {
+        // Validate admin token
+        if (string.IsNullOrWhiteSpace(adminToken) || string.IsNullOrWhiteSpace(AdminResetToken))
+        {
+            _logger.LogWarning("Admin password reset attempted without admin token or token not configured");
+            return false;
+        }
+
+        if (!CryptographicOperations.FixedTimeEquals(
+                Encoding.UTF8.GetBytes(adminToken),
+                Encoding.UTF8.GetBytes(AdminResetToken)))
+        {
+            _logger.LogWarning("Invalid admin reset token provided");
+            return false;
+        }
+
+        if (string.IsNullOrWhiteSpace(email) || string.IsNullOrWhiteSpace(newPassword))
+            return false;
+
+        if (newPassword.Length < 10)
+            return false;
+
+        var normalizedEmail = NormalizeEmail(email);
+        var user = await _users.GetByEmailAsync(normalizedEmail, ct);
+
+        if (user is null)
+        {
+            _logger.LogWarning("Admin password reset: user {Email} not found", email);
+            return false;
+        }
+
+        user.PasswordHash = PasswordSecurity.Hash(newPassword);
+        user.UpdatedAt = DateTimeOffset.UtcNow;
+        await _users.UpdateAsync(user, ct);
+
+        _logger.LogInformation("Admin password reset completed for {Email}", email);
+        return true;
+    }
+
     private async Task<AuthSession?> CreateSessionAsync(
         NexusUser user,
         Guid familyId,