PM-39006: Bug: Update the setPassword flow for TDE users

[david-livefront]

🎟️ Tracking

PM-39006

📔 Objective

This PR address some issues in the setPassword flow for TDE user.

Main changes:

1. Wrap the entire setPassword function in a userStateTransaction to ensure no state-based navigation occurs when processing the change.
2. Do not attempt to unlock the vault after setting the password, the vault is already unlocked and attempting to do so causes an error.
3. Ensure the MasterPasswordUnlockData is set before trying to unlock the vault, that data is now required.
4. Store the ForcePasswordResetReason on sync in order to ensure the correct flow is followed.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the TDE setPassword flow changes in AuthRepositoryImpl and the sync-time profile updates in UserStateJsonExtensions. The change wraps setPassword in a userStateTransaction to suppress state-based navigation mid-flow, removes the redundant vault unlock for already-unlocked TDE users, makes MasterPasswordUnlockData required when persisting the password, and computes ForcePasswordResetReason on sync. Logic was traced across the TDE, admin-reset, weak-password, and no-permission paths; all behave correctly and are covered by new and updated tests.

Code Review Details

No blocking findings.

Notes considered and cleared during review:

• State write in setUpdatedPassword.onSuccess runs after the server confirms the password is set and before enrollment — ordering is correct and consistent with the JIT V1 flow.
• salt = profile.email matches the test fixtures (EMAIL / BASE_PROFILE_1.email).
• getForcePasswordResetReason reads permissions.shouldManageResetPassword on a non-null Permissions, so no NPE risk; the ?: previousForcePasswordResetReason fallback preserves prior reasons correctly for master-password users.
• The hasMasterPassword = false fallback when sync has no userDecryption is a deliberate behavioral change aligned with the PR intent and covered by an updated test.

[aj-rosado]

LGTM

[david-livefront]

Thanks @aj-rosado