Owner accounts: auth, password reset, CRM dashboard visibility (#19)

Flask-session login scoped to one client_id (never a request param),
self-service + operator-triggered password reset via single-use tokens,
and an Owner accounts tab on the CRM dashboard.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backoffice/docker-compose.yml

@@ -25,6 +25,7 @@ services:
       DATABASE_URL: postgresql://smbcrm:${DB_PASSWORD}@smb-db:5432/smbcrm
       CRM_API_TOKEN: ${CRM_API_TOKEN}
       BOOKING_TOKEN_SECRET: ${BOOKING_TOKEN_SECRET}
+      SESSION_SECRET_KEY: ${SESSION_SECRET_KEY}
       ICS_TOKEN: ${ICS_TOKEN}
       SHEET_ID: ${SHEET_ID}
       GOOGLE_SA_JSON: /run/secrets/gcp-sa.json