[upstream #4763] feat(core): Admin-driven customer verification and password reset

[ayim]

Mirrored from vendurehq#4763 for the Overwatch review demo.

Original author: @tbouliere-datasolution

---

Description

This PR adds two administrator-driven actions on the Customer detail to handle the cases where a customer can no longer self-serve their account state — either because they never confirmed their verification email or because they've lost access to their inbox.

Two new admin-API mutations are exposed on the Customer namespace:

• verifyCustomerAccountAsAdmin(customerId: ID!) — completes the email-verification step for a registered but unverified Customer with a randomly generated 16-character password, bypassing the verification-token flow. The cleartext password is returned once in the response
  (via the new AdminGeneratedPassword type) so the administrator can communicate it to the customer; it is not persisted anywhere else. A CUSTOMER_VERIFIED history entry is written and an AccountVerifiedEvent is published.
• resetCustomerPasswordAsAdmin(customerId: ID!) — administrator-driven counterpart to the storefront requestPasswordReset mutation. For a verified Customer, it issues a password-reset token and publishes a PasswordResetEvent so the configured email handler can send the
  customer a reset link. No password is generated or returned — the customer chooses their new password through the standard reset flow.

A new CustomerAccountStateError (with an accountState: String field — "guest", "registered", or "verified") surfaces the cases where the action does not apply to the current account state. Under the hood, a new UserService.resetPasswordAsAdmin(ctx, userId, newPassword)
primitive performs the direct password reset without a token (also marking the user as verified if it wasn't already), and a getUserByIdWithPasswordHash helper consolidates the passwordHash-selecting query previously inlined in setPassword.

The Vendure Dashboard customer detail page gains a corresponding action button to invoke either mutation depending on the customer's current state.

Breaking changes

No breaking changes. This PR is purely additive:

• New GraphQL types (AdminGeneratedPassword, CustomerAccountStateError) and unions (VerifyCustomerAccountAsAdminResult, ResetCustomerPasswordAsAdminResult).
• New mutations behind the existing Permission.UpdateCustomer permission.
• New public method on UserService (resetPasswordAsAdmin).
• The internal refactor in UserService.setPassword (extracting getUserByIdWithPasswordHash) preserves the existing behavior.

Screenshot

---

---

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}