fix: resolve P0 stub/false-positive issues found in SENIOR_DEV_REVIEW audit

- Remove dead stub UploadAvatar in user_handler.go (real impl in avatar_handler.go)
- Fix GetAuthCapabilities to call service (was returning hardcoded static JSON, missing admin_bootstrap_required)
- Replace AdminRoleID=1 hardcoded constant with getAdminRoleID(ctx) dynamic lookup by code="admin"
- Fix double Argon2id hash computation in ChangePassword (hash once, reuse)
- Add PredefinedRoles seed to newIsolatedDB test infrastructure (fixes broken ADMIN_* tests)

internal/api/handler/auth_handler.go

@@ -189,11 +189,12 @@ func (h *AuthHandler) GetCSRFToken(c *gin.Context) {
 }
 
 func (h *AuthHandler) GetAuthCapabilities(c *gin.Context) {
+	ctx := c.Request.Context()
+	caps := h.authService.GetAuthCapabilities(ctx)
 	c.JSON(http.StatusOK, gin.H{
-		"register":      true,
-		"login":        true,
-		"oauth_login":  false,
-		"totp":         true,
+		"code":    0,
+		"message": "success",
+		"data":    caps,
 	})
 }