[codex] Restore admin in root reset firmware

[massif-01]

Summary

• update the 9.9.9 root-reset recovery firmware to restore both root and admin credentials to rm01
• keep the recovery build app-only and isolated from WebUI/API/network/SSH/console components
• share the admin default password and admin credential key in ts_auth_layout
• update recovery firmware docs and build script wording from root-only to root/admin

Why

The previous recovery firmware only reset ts_auth/cred_root. In a controlled recovery scenario where admin access is also unavailable, that still leaves the device unusable through normal admin workflows after recovery. This change makes the recovery behavior explicit and symmetrical for the two built-in auth users while preserving the same NVS layout version.

Scope and Compatibility

• v0.5.1 release assets and tag are not changed by this PR.
• Normal firmware builds do not compile root_password_reset_main.c; the recovery entrypoint is only selected when ROOT_PASSWORD_RESET=ON.
• The normal auth module continues to use the same default admin password value, now via TS_AUTH_DEFAULT_ADMIN_PASSWORD.
• NVS layout version remains TS_AUTH_CONFIG_VERSION == 3; the credential struct and offsets are unchanged.

Validation

• git diff --check
• ROOT_PASSWORD_RESET_VERSION=9.9.9 ./tools/build_root_reset.sh
• parsed generated app desc through OTA_Server/server.py
• verified recovery build version: 9.9.9-root-reset.172435.339f05
• verified generated firmware SHA256: 75a4cfe92ceebe3433792c97b65cfec537b91b390f1d0b7a5ba5c84200c843a3
• verified recovery build main source is only root_password_reset_main.c
• verified recovery build does not include normal system components such as WebUI/API/network/SSH/console

Release Note

The v9.9.9-root-reset prerelease has been updated to contain only the app-only recovery firmware asset:

• TianShanOS-RootReset-v9.9.9.bin

Full-flash helper assets and normal firmware/WebUI assets were removed from that prerelease to avoid accidental full-device flashing.