chore: v2.8.15 — Oh My Pi login sharing, omp --allow-home, Markdown Preview default, first-login password

- omp-share.js: an admin's switch (S3) runs omp's own auth broker + gateway as
  the host on loopback; a member's omp pane reaches it as a scoped client keyed
  by its pane token (clients file = live omp panes only), runs on
  --model agenthub/<model>, never holds a credential.
- omp catalog: --allow-home, so a workspace at the account's home keeps its
  sessions there (they were recorded under a temp dir and dropped).
- Settings → Appearance → Open Markdown as: Preview (default) or Raw, for
  Files/Changes, the config viewer and a chat's file panel.
- First-login password change and password rules, avatar URLs, Artifacts
  "Mine" includes installed shared skills/plugins, a member's own hook pages.

server/db.js

@@ -1942,6 +1942,19 @@ for (const col of ["display_name", "email", "avatar_at"]) {
     db.prepare(`ALTER TABLE users ADD COLUMN ${col} TEXT`).run();
   }
 }
+// When the account last logged in (kept past its logins' expiry, unlike
+// `auth_sessions`), and whether it must pick its own password before anything
+// else (set when an admin creates it or resets its password — server/lib/auth.js).
+for (const [col, type] of [
+  ["last_login_at", "TEXT"],
+  ["must_change_password", "INTEGER NOT NULL DEFAULT 0"],
+]) {
+  try {
+    db.prepare(`SELECT ${col} FROM users LIMIT 1`).get();
+  } catch {
+    db.prepare(`ALTER TABLE users ADD COLUMN ${col} ${type}`).run();
+  }
+}
 // An admin's pin of one server-mode user to one pool account per tool
 // (server/lib/account-pins.js): that user's new sessions skip the balancer.
 // The account is named, not referenced — the pool lives in files.