Fix auth bypasses, race condition, stale connections, and unbounded query

- Block disabled accounts at login and unimpersonate (C4, C2)
- Catch IntegrityError on register commit to return 409 instead of 500 (C5)
- Stop _seed_admin from overwriting existing admin password on restart (C8)
- Cap public/stats query at 500 users to bound memory usage (C3)
- Rate-limit PUT /me/password at 5/minute (C6)
- Bump SQLAlchemy to 2.0.50 and aiomysql to 0.3.2; re-enable pool_pre_ping (C7)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/routers/users.py

@@ -1,7 +1,8 @@
-from fastapi import APIRouter, Depends, HTTPException, status
+from fastapi import APIRouter, Depends, HTTPException, Request, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.dependencies import get_db, get_current_user
+from app.limiter import limiter
 from app.models.user import User
 from app.schemas.user import UserResponse, UserUpdate, PasswordChange
 from app.utils.security import verify_password, hash_password
@@ -33,7 +34,9 @@ async def update_me(
 
 
 @router.put("/me/password", status_code=status.HTTP_204_NO_CONTENT)
+@limiter.limit("5/minute")
 async def change_password(
+    request: Request,
     body: PasswordChange,
     db: AsyncSession = Depends(get_db),
     current_user: User = Depends(get_current_user),