Say which accounts belong to the provider, and to whom

"Has an identity at the provider" and "has no password here" are two
different questions, and the interface was answering the second while being
asked the first: an account that existed before and was linked — the usual
case for whoever sets this up — carried no mark at all in the administration
list.

The server now reports both. The list marks every linked account, says which
of them have no password, and offers to give one rather than to reset
something that is not there. The account panel names the provider it signs in
through, which is also the missing explanation for the password tab that
disappeared.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/server.js

@@ -278,9 +278,14 @@ const publicUser = (row) => ({
   displayName: row.display_name,
   isAdmin: !!row.is_admin,
   preferences: readPreferences(row.preferences),
-  /* Whether this account has a password at all. The interface needs it to stop
-   * offering "change password" to somebody who signs in through the provider,
-   * and the administration list to show which accounts those are. */
+  /* Two different things, and the interface needs both.
+   *
+   * `linkedToProvider` — this account has an identity at the provider and can
+   * sign in through it. `signsInWithProvider` — it has *no password here at
+   * all*, which is true of accounts the provider created and not of an existing
+   * account that was later linked. The first decides whether to say so; the
+   * second decides whether there is a password to offer changing. */
+  linkedToProvider: !!row.oidc_sub,
   signsInWithProvider: isProviderOnly(row),
 });