fix: route every credit request to an administrator, and finish the admin console gaps

[Mkpong]

Five changes, grouped by concern: three fixes to how credits, passwords and group
wallets behave for administrators, the frontend dependency upgrade that unblocks CI,
and the documentation site's locale and spelling pass.

Credit requests reached nobody

A credit request is stored as pending, and its only route to a person is the
notification raised when it is created. That route was empty in two ways.

The organization lookup joined the group table, which matches only the legacy shape of
the role (org_admin written onto a group membership). Administrators are appointed at
the organization level, so on a current install the query found nobody at all — a
group's request notified no one even when the organization had an administrator. The
same defective query sat in the shared notification helper, so budget alerts missed
organization administrators too.

A tier with no administrator also notified nobody rather than passing the request up.

Both are fixed. The lookup now finds administrators in either membership shape, and each
tier falls back to the one above it: a group with no administrator reaches its
organization, an organization with none reaches the system administrators. A closer
administrator is always preferred, so nothing extra reaches the system tier while the
hierarchy is staffed.

A system administrator's inbox now also lists requests whose own tier has nobody to
decide them, under exactly the same condition the notification uses. Without that, the
notification opened an inbox that did not contain the request, and it could only be
decided through the API.

Administrators can put a locked-out user back in

The console's only password control sent a chosen password, which the API refuses for
anyone but the account's own owner. No administrator could help someone who had
forgotten theirs.

A new endpoint issues a random password instead, returns it once, and forces a change at
the user's next sign-in. Nobody picks another person's password, system administrators
included. A group administrator may reset only inside their own group, and nobody may
reset an account that outranks them. The console shows the issued value once with a copy
control.

Every group can be funded

The group wallet was an opt-in checkbox at creation time. A group created with it cleared
could never be allocated credits, and nothing could add the wallet afterwards, so a
single unchecked box meant recreating the department. Creation now always makes one, a
startup seed fills in groups that predate the change, and the checkbox is gone.

Chart: a repository that names its own registry

The image helper prefixed global.imageRegistry unconditionally, so pointing one image
at a different registry rendered an invalid reference and the pod failed with
InvalidImageName. A repository whose first path segment carries a dot or a colon is now
treated as naming its own host and used as it stands; a bare name is prefixed as before.

Frontend dependencies

Tailwind 4, Vite 8, Vitest 5, ESLint 10, React Router 7 and the packages that must move
with them, which is what the open Dependabot pull requests were failing on.
.github/dependabot.yml now groups the peer-dependent packages so they are proposed
together rather than one at a time. CI's frontend job moves to Node 22, which Vitest 5
and jsdom 30 require.

Documentation site

Korean is served at the site root and English at /en, using per-locale base URLs. No
content moved. Admonition titles are bracketed so Docusaurus 3 renders them as directives
instead of printing :::. English text uses American spellings throughout.

Verification

• Backend: 528 passed, 9 skipped; ruff clean.
• Frontend: eslint clean, 48 tests passed, production build clean.
• Chart: helm lint clean; both locales of the documentation site build.
• Trivy reports no vulnerabilities at medium and above on the new lockfile.