[SandObserver]

Summary

• Add shouldWritePassword beside authEnableBlocked and gate the set-password call on it, so a password typed in the same save that switches protection off is never written; writing it rotated the session secret, signing every other device out, before the toggle deleted it again.
• Clear the password field when the same save turns protection off, so the box does not read as a password the dashboard now holds.
• Reject a /api/auth/toggle body whose enabled is not a boolean; {}, null, 0 and "false" were read as off and permanently deleted passwordHash and secret.
• Lift the sign-out and revoke row sync to module scope and call it after a save clears the password, where the rows could stay visible and the revoke button answered with an error.
• Attach the toggle's change listener unconditionally. It was guarded on sec-sub, which exists nowhere in the markup, so the listener never ran; the same dead branch wired the password strength meter, which initSecToggle in admin.js already does.
• Translate the password and Unsplash key status labels through new common.configured and common.notSet keys in all six locales.
• Record in auth.js that clearing the hash lets anyone who can reach the dashboard while protection is off set a password, which is accepted because protection being off already exposes the whole config.

Testing
All green: 1092 backend, 609 frontend, 94.8% line coverage, lint, format, both typechecks, paths:check and cache-busting. Added 9 tests: six malformed toggle bodies that must change nothing, and the write-password rule.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.
• CHANGELOG.md updated under Unreleased if the change is user-visible.