feat(admin): hqsync repairs stale projected passwords

Its own package rather than a pass inside inject: inject writes three
licence fields and nothing else, and that narrowness is what makes admin's
reach into the control plane reviewable.

Repairs by copying HQ's hash, not by re-hashing — two bcrypt hashes of one
password differ by salt, so a re-hash would never converge.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

admin/cmd/main.go

@@ -15,6 +15,7 @@ import (
 	"github.com/mrhid6/vantage/admin/internal/auth"
 	"github.com/mrhid6/vantage/admin/internal/config"
 	"github.com/mrhid6/vantage/admin/internal/db"
+	"github.com/mrhid6/vantage/admin/internal/hqsync"
 	"github.com/mrhid6/vantage/admin/internal/inject"
 	"github.com/mrhid6/vantage/admin/internal/licensing"
 	"github.com/mrhid6/vantage/admin/internal/lifecycle"
@@ -76,6 +77,7 @@ func main() {
 	reconcileCtx, stopReconcile := context.WithCancel(context.Background())
 	defer stopReconcile()
 	inject.StartReconciler(reconcileCtx)
+	hqsync.Start(reconcileCtx)
 
 	lifecycle.SetPortalURL(cfg.PublicURL)
 	lifecycle.Start(reconcileCtx, cfg.ReapAfter)