case 4725 - sessions end on password reset and login disabled, exact login route, default SuperUser limited when licensed

A password set by someone else (reset code, administrator) or a disabled
login replaces the user's session token and download key; changing one's
own password keeps the session. PasswordResetCodeExpire is cleared (was
DlKeyExpire). The token middleware exempts only the exact login and
notify/hello routes and refuses inactive users and users who may not log
in. With a purchased licence, notify/hello no longer offers the default
SuperUser login and a SuperUser with the default password may only change
it (SuperUserDefaultPasswordRoutes). F7, F8 and F9 fixed. Manual and
changelog updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/AyaNova/Controllers/NotifyController.cs

@@ -51,7 +51,8 @@ namespace AyaNova.Api.Controllers
             if (AyaNova.Core.License.ActiveKey.Status == AyaNova.Core.License.AyaNovaLicenseKey.LicenseStatus.ActiveTrial)
                 showSampleLogins = await AyaNova.Util.DbUtil.DBHasTrialUsersAsync(ct, log);
 
-            bool suIsDefault = await UserBiz.SuperIsDefaultCredsAsync(ct);
+            //case 4725: the default SuperUser login is offered only while unlicensed or in trial
+            bool suIsDefault = !AyaNova.Core.License.PurchasedLicense() && await UserBiz.SuperIsDefaultCredsAsync(ct);
             //confirm if there are logo's to show as well
             var logo = await ct.Logo.AsNoTracking().SingleOrDefaultAsync();