`./run.sh --reset-admin-password` rebuilds the binary whenever it is missing or
older than the sources, through build_go_project_quiet - the one build path left
that compiled the single file `cmd/server/main.go`. A file-based go build only
compiles the file it names, so it dropped every sibling of package main that
this PR added; measured on the parent commit:
cmd/server/main.go:35:22: undefined: updateCommandIfNeeded
(the symbol lives in cmd/server/update_cli.go), which made the documented
password-reset entry exactly the path that could not build itself. The normal
start path and upgrade.sh already build `./cmd/server`; the quiet path now does
too, and a test scans run.sh, upgrade.sh and scripts/*.sh so a file-based
go build cannot come back unnoticed - it fails on the pre-fix tree with the
command named.
The CLI now lives in two files (main.go and update_cli.go), so
`go build cmd/server/main.go` compiles only main.go and leaves
updateCommandIfNeeded undefined - which is exactly how run.sh (twice) and both
READMEs built. `go build ./cmd/server` compiles the whole package; run.sh's
rebuild check already scans internal/ and cmd/ for newer sources, so nothing
else needed adjusting.