gitea: don't leave the admin account locked behind a password-change wall

Root cause of the "Failed to reach Gitea API" / 403 errors on every retry:
`gitea admin user change-password` (used in the already-exists branch to
sync the account's password to what the user just entered) defaults to
setting must_change_password=true, unlike `user create` which was already
pinned to --must-change-password=false. Once set, Gitea rejects every API
call — including the sync script's own token-authenticated calls — with
403 "You must change your password", even though the token itself and
GITEA_URL were both completely correct. Confirmed live via a direct curl
against /api/v1/user.

Pin the same flag on change-password that create already used.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YEQNc4NfBST1m9NtCZVYa8

services/gitea.sh

@@ -386,8 +386,16 @@ EOF
         # what was just entered rather than failing the whole install.
         if docker exec -u git gitea gitea admin user list 2>/dev/null | awk '{print $2}' | grep -qx "$GITEA_ADMIN_USER"; then
             _exists=true
+            # --must-change-password=false matters here: change-password
+            # defaults to setting that flag TRUE, which then makes Gitea
+            # reject every API call (including this script's own token-based
+            # calls) with 403 "You must change your password" until someone
+            # logs into the web UI and clears it by hand. Confirmed live —
+            # this silently broke the sync script on every retry against an
+            # already-existing account.
             docker exec -u git gitea gitea admin user change-password \
-                --username "$GITEA_ADMIN_USER" --password "$GITEA_ADMIN_PASS" &>/dev/null
+                --username "$GITEA_ADMIN_USER" --password "$GITEA_ADMIN_PASS" \
+                --must-change-password=false &>/dev/null
             _created=true
             break
         fi