fix(scripts): detect container vs host layout reliably in reset_admin_password

Replace heuristic directory scan with explicit container detection:
/app/scripts path means container, script sibling to api/ means host.
Prevents accidental /app/data/api misdetection when that dir exists.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/reset_admin_password.py

@@ -12,19 +12,15 @@ import secrets
 import string
 
 _here = os.path.dirname(os.path.abspath(__file__))
-# Find auth_manager: host layout has api/ sibling, container has it one level up at /app
-for _api_path in [os.path.join(_here, '..', 'api'), os.path.join(_here, '..'), '/app']:
-    if os.path.isfile(os.path.join(_api_path, 'auth_manager.py')):
-        sys.path.insert(0, os.path.normpath(_api_path))
-        break
+# In container the script lives at /app/scripts/; on host at <repo>/scripts/
+_in_container = os.path.abspath(_here) == '/app/scripts'
 
-ROOT = os.path.normpath(os.path.join(_here, '..'))
-# data dir: host uses ROOT/data/api, container mounts data/api at ROOT/data
-for _data in [os.path.join(ROOT, 'data', 'api'), os.path.join(ROOT, 'data'), '/app/data']:
-    if os.path.isdir(_data):
-        _DATA_DIR = _data
-        break
+if _in_container:
+    sys.path.insert(0, '/app')
+    _DATA_DIR = '/app/data'
 else:
+    ROOT = os.path.normpath(os.path.join(_here, '..'))
+    sys.path.insert(0, os.path.join(ROOT, 'api'))
     _DATA_DIR = os.path.join(ROOT, 'data', 'api')
 
 INIT_PW_FILE = os.path.join(_DATA_DIR, '.admin_initial_password')