Set a password from forgot-password as an SSO-only user

[elias-ba]

The existing forgot-password flow works for users who signed up via SSO and have no password yet. They can request a reset link by email and set a password from the link.

The forgot-password screen itself is unchanged; only the backend changes to let users with no password set one via the existing flow.

[doc-han]

Implemented in #4751