Allow admins to manage user passwords

backend/test/accessPolicy.test.js

@@ -6,6 +6,7 @@ const {
   canManageUserStatus,
   canChangeUserEmail,
   canManageUserRoleOrTeam,
+  canManageUserPassword,
   canReadAttendance,
 } = require('../policies/accessPolicy');
 
@@ -48,6 +49,13 @@ test('only admins can manage role, team, and status fields', () => {
   assert.equal(canChangeUserEmail(manager, agent), false);
 });
 
+test('only admins can manage user passwords', () => {
+  assert.equal(canManageUserPassword(superAdmin), true);
+  assert.equal(canManageUserPassword(admin), true);
+  assert.equal(canManageUserPassword(manager), false);
+  assert.equal(canManageUserPassword(agent), false);
+});
+
 test('attendance detail policy matches role boundaries', () => {
   const ownAttendance = { id: 'att_1', tenant_id: 'tenant_a', user_id: 'u_agent', team_id: 'team_a' };
   const teamAttendance = { id: 'att_2', tenant_id: 'tenant_a', user_id: 'u_another', team_id: 'team_a' };