Add email sending (service + 3 flows) and a general asset label generator

Email: a stdlib SMTP mailer (settings-first config, graceful no-op when
unconfigured), a test-email endpoint wired to the Email settings page,
forced first-login password change (users.mustchangepassword, migration
7d23, /change-password flow), new-user welcome mail, and on-demand
report/alert delivery (POST /api/reports/email + Email Report buttons)
with an external-cron-with-a-scoped-PAT path documented for automation.
All tests patch smtplib - no network.

Labels: a shared /print/asset-label/<type>/<id> view any asset detail
page opens - card or plain style, QR or barcode, configurable encoding.
Per-type qr_target_* templates plus label_default_style/codetype/encodes
settings on the Printing page. Measuring-tool labels default to encoding
their inspection-operation code (derived from the location name, e.g.
0615), so every tool in an area shares the area code - verified by
decoding the rendered QR. Machine labels default to the machine number;
blank-serial handled gracefully.

808 tests pass; both features verified live.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

frontend/src/api/index.js

@@ -60,6 +60,9 @@ export const authApi = {
     return api.post('/auth/refresh', {}, {
       headers: { Authorization: `Bearer ${refreshToken}` }
     })
+  },
+  changePassword(payload) {
+    return api.post('/auth/change-password', payload)
   }
 }
 
@@ -714,6 +717,11 @@ export const reportsApi = {
   },
   pcRelationships(params = {}) {
     return api.get('/reports/pc-relationships', { params })
+  },
+  // On-demand report delivery: email the given rows as an HTML table.
+  // Recipients default to the site Alert Recipients when `to` is omitted.
+  email(payload) {
+    return api.post('/reports/email', payload)
   }
 }
 
@@ -822,6 +830,9 @@ export const settingsApi = {
   update(key, value) {
     return api.put(`/settings/${key}`, { value })
   },
+  testEmail(to) {
+    return api.post('/settings/test-email', { to })
+  },
   create(data) {
     return api.post('/settings', data)
   },