Activates a user account that was created with requirePasswordChange=true.
This endpoint validates the single-use activation token and allows the user to set their own password.

Applicable to ALL user types:

• Tenant administrators (provisioned by platform admins)
• Platform administrators (created by platform admins in tenant 001)
• Regular users (created by tenant admins)
• Any user account requiring password setup on first login

Process:

1. Validates activation token (signature, expiration, purpose claim)
2. Checks token hasn't been used (single-use via Redis blacklist)
3. Updates user password with secure PBKDF2 hashing
4. Marks account as active (removes requirePasswordChange flag)
5. Adds token JTI to Redis blacklist to prevent reuse

Token Requirements:

• Valid RS256 signature from Admin-API
• Purpose claim = 'ACCOUNT_ACTIVATION'
• Not expired (configurable, default: 24h)
• Not previously used (checked via Redis blacklist)
• Valid tenant and user UUIDs in claims

Security Model:
This endpoint enables zero-knowledge user provisioning where administrators never see
or know user passwords. Users set their own passwords, following OWASP ASVS 2.1.1
and industry best practices (AWS Cognito, Azure AD, Auth0 pattern).