fix: set passwordLoginEnabled in the unit test; refresh status doc comment

PasswordlessAuthServiceTest uses @Injectmocks, and Mockito does not process
@value — every such field is set by hand with ReflectionTestUtils. The new
passwordLoginEnabled boolean was not, so it defaulted to false and both
loginWithPassword tests hit the new rejection branch and failed.

Worth spelling out because the polarity is the trap: rateLimitEnabled is
also unset in this test and that is harmless, because it is read as
`if (rateLimitEnabled)` — absence just skips the feature. Password login is
read as `if (!passwordLoginEnabled)`, so absence blocks every login instead.

Also refreshes the getStatus() doc comment in client.js, which still listed
only the four original fields.

Verified: PasswordlessAuthServiceTest 2/2, SetupControllerTest 6/6, no
failures, errors or skips.

Author: geekypunk

backend/src/test/java/com/dbaagent/service/PasswordlessAuthServiceTest.java

@@ -57,6 +57,11 @@ void setUp() {
         ReflectionTestUtils.setField(service, "maxIpStarts", 20);
         ReflectionTestUtils.setField(service, "maxPasswordFailures", 10);
         ReflectionTestUtils.setField(service, "adminMfaEnabled", false);
+        // @Value is not processed by @InjectMocks, so a boolean field defaults to
+        // false. Unlike rateLimitEnabled (checked as `if (enabled)`, so absence
+        // merely skips it), password login is checked as `if (!enabled)` — leaving
+        // it unset would reject every login below.
+        ReflectionTestUtils.setField(service, "passwordLoginEnabled", true);
 
         when(authLoginChallengeRepository.save(any(AuthLoginChallenge.class)))
             .thenAnswer(invocation -> invocation.getArgument(0));

src/lib/api/client.js

@@ -3682,7 +3682,8 @@ export const setupAPI = {
 
   /**
    * Returns current setup state: setupComplete, hasOrganizationInfo,
-   * hasConnections, hasLlmConfig. Public endpoint — no auth required.
+   * hasConnections, hasLlmConfig, googleEnabled, passwordLoginEnabled.
+   * Public endpoint — no auth required.
    */
   getStatus: async () => {
     const response = await apiClient.get("/api/setup/status");