Invalidate pending first-access tokens when password setup succeeds

Password setup is the completion point of backoffice first access. After a valid PIN is found and the new password is persisted, invalidate all pending first-access tokens for that partner in the same transaction.

Consequences

• A token cannot remain valid after onboarding has completed.
• Retrying the password setup flow with an older pending token fails safely.
• Creating a new partner does not need to invalidate tokens, because token invalidation is tied to completion of that partner’s access setup rather than creation of another record.
• Tests should cover both successful password setup with invalidation and invalid PIN handling without mutation.