studio: change login error to "Incorrect password", add reset-password CLI

- Login error now says "Incorrect password" instead of the generic
  "Incorrect username or password" since Studio only has one account.
- Add `unsloth studio reset-password` command that deletes the auth
  database so a fresh admin account with a new random password is
  created on the next server start.

cli/commands/studio.py

@@ -178,3 +178,28 @@ def setup():
 
     if result.returncode != 0:
         raise typer.Exit(result.returncode)
+
+
+# ── unsloth studio reset-password ────────────────────────────────────
+
+
+@studio_app.command("reset-password")
+def reset_password():
+    """Reset the Studio admin password.
+
+    Deletes the auth database so that a fresh admin account with a new
+    random password is created on the next server start.  The Studio
+    server must be restarted after running this command.
+    """
+    auth_dir = STUDIO_HOME / "auth"
+    db_file = auth_dir / "auth.db"
+    pw_file = auth_dir / ".bootstrap_password"
+
+    if not db_file.exists():
+        typer.echo("No auth database found -- nothing to reset.")
+        raise typer.Exit(0)
+
+    db_file.unlink(missing_ok = True)
+    pw_file.unlink(missing_ok = True)
+
+    typer.echo("Auth database deleted. Restart Unsloth Studio to get a new password.")

studio/backend/routes/auth.py

@@ -54,14 +54,14 @@ async def login(payload: AuthLoginRequest) -> Token:
     if record is None:
         raise HTTPException(
             status_code = status.HTTP_401_UNAUTHORIZED,
-            detail = "Incorrect username or password",
+            detail = "Incorrect password",
         )
 
     salt, pwd_hash, _jwt_secret, must_change_password = record
     if not hashing.verify_password(payload.password, salt, pwd_hash):
         raise HTTPException(
             status_code = status.HTTP_401_UNAUTHORIZED,
-            detail = "Incorrect username or password",
+            detail = "Incorrect password",
         )
 
     access_token = create_access_token(subject = payload.username)