Add Custom Roles account recovery permission (#7965)

migrations/mysql/2026-11-14-120000_add_custom_role_manage_reset_password/down.sql

@@ -0,0 +1,13 @@
+-- Dropping the permission would silently take it away from the Custom members holding it. So while there are any,
+-- this fails on the duplicate key below, before anything is dropped: take it away first, or restore the backup
+-- taken before the upgrade.
+-- A failed attempt leaves the temporary table on this connection. Clear it before retrying.
+DROP TEMPORARY TABLE IF EXISTS custom_role_downgrade;
+CREATE TEMPORARY TABLE custom_role_downgrade (blocked_by VARCHAR(255) NOT NULL PRIMARY KEY);
+INSERT INTO custom_role_downgrade VALUES ('Manage account recovery: take it away first, or restore the backup taken before the upgrade');
+INSERT INTO custom_role_downgrade
+    SELECT 'Manage account recovery: take it away first, or restore the backup taken before the upgrade'
+    FROM users_organizations WHERE manage_reset_password LIMIT 1;
+DROP TEMPORARY TABLE custom_role_downgrade;
+
+ALTER TABLE users_organizations DROP COLUMN manage_reset_password;

migrations/mysql/2026-11-14-120000_add_custom_role_manage_reset_password/up.sql

@@ -0,0 +1,3 @@
+-- The Manage account recovery permission of the Custom member role. Like the other permissions it only takes
+-- effect on a Custom membership (atype 4) while EXPERIMENTAL_CUSTOM_ROLES is enabled, and nobody starts with it.
+ALTER TABLE users_organizations ADD COLUMN manage_reset_password BOOLEAN NOT NULL DEFAULT FALSE;