Add internal grant endpoint + temp-password / force-change flow

- /api/internal/grant: secret-auth endpoint for payment-router to
  provision access on a paid order — find-or-create user (emailVerified,
  temp password, mustChangePassword), enroll by course slug list,
  AccessLog, delivery email. Idempotent by order_id.
- User.mustChangePassword flag (+ migration); (student) layout redirects
  flagged users to /change-password (forced first-login change).
- email.ts: sendCourseGrantEmail (temp password for new buyers).
- middleware: /api/internal is public (own secret auth).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/app/change-password/page.tsx

@@ -0,0 +1,26 @@
+import { headers } from "next/headers";
+import { auth } from "@/lib/auth";
+import { redirect } from "next/navigation";
+import { ForceChangeForm } from "./force-change-form";
+
+export default async function ChangePasswordPage() {
+  const session = await auth.api.getSession({ headers: await headers() });
+  if (!session) redirect("/login");
+
+  return (
+    <div
+      className="min-h-screen flex items-center justify-center p-4"
+      style={{ backgroundColor: "var(--background)" }}
+    >
+      <div className="w-full max-w-sm">
+        <h1 className="text-xl font-bold mb-2" style={{ color: "var(--foreground)" }}>
+          Задайте свой пароль
+        </h1>
+        <p className="text-sm mb-6" style={{ color: "var(--muted-foreground)" }}>
+          Вы вошли с временным паролем. Перед началом работы задайте постоянный — это займёт минуту.
+        </p>
+        <ForceChangeForm />
+      </div>
+    </div>
+  );
+}