PR-B of two for #39. Builds on #41 (Connect flow) to close out the frontend portion of the issue.

Summary

• Plumb has_usable_password from /auth/me through the auth context (defaults to false on missing/stale responses).
• Disconnect button per linked provider on /profile. Disabled with an inline hint ("You'd have no way to sign in. Set a password first or link another provider.") when removing it would strand the user — mirrors the server-side rule client-side so users don't have to click to learn it's blocked:

  canUnlink = otherConnections.length > 0
            || (hasUsablePassword && email)

• DELETE /auth/me/connections/{provider} on click:
  • 204 → refresh /auth/me/connections + /auth/me, toast "Disconnected ."
  • 409 unlink_would_strand_user → render the message + remediation list inline (amber alert). Remediation strings matching /set a password/ get a "Start now" Link to /forgot-password?email=<email>. Re-syncs connections + auth in case the server saw a different reality.
  • 404 connection_not_found → refresh connections, toast "That connection is already disconnected."
• "Set a password" CTA in the connections section when has_usable_password=false, linking to /forgot-password?email=<email>.
• forgot-password route now accepts ?email= via validateSearch and prefills the input. The "authenticated user → /profile" guard relaxes when ?email= is present so the CTA works without forcing a logout.

Closes

Together with #41, the frontend portion of #39 (Steam associate flow + connect/disconnect settings UI) is done.

Test plan

Unit (vitest, 6 new tests, 45 total — all passing)

• forgot-password-page.test.tsx — empty default, ?email= prefill.
• profile-page.test.tsx — Disconnect disabled with helper text when stranding, DELETE on click + list refresh + success toast, 409 → rendered remediation list with "Start now" Link, "Set a password" CTA visible when has_usable_password=false.
• All other auth-context test contexts updated for the new hasUsablePassword field (default false for unauth, true for the existing auth fixtures).

What's not in this PR

• E2E re-run. PR-A (feat(connections): account linking — Connect flow + callback purpose dispatch #41) already verified the connections section round-trip live against the local API + Postgres; the net-new logic here (Disconnect button rendering, stranding guard, 409 remediation rendering, CTA, forgot-password prefill) is mechanical UI on top of the same wiring and is fully covered by the new unit tests. Happy to run a fresh Playwright session if you'd prefer it before merging — just ask.

Reviewer checklist

• pnpm test:run
• Locally: log in as a user with both Google and Steam linked → both rows show Disconnect, both enabled.
• Log in as a user with has_usable_password=false and only Google linked → Disconnect shows but is disabled with the "no way to sign in" hint, and the "Set a password" CTA appears below.
• Click the CTA → lands on /forgot-password with the email prefilled.