Fix #1537: warn when app passwords are disabled

[Keegil]

Summary

• add an explicit warning in the New App Password section when the master app-password switch is disabled
• keep the existing enable/disable flow unchanged while making the disabled state much easier to notice before creating a password
• add a focused component spec that covers the warning visibility for enabled and disabled states
• update the generated changelog

Problem

Users could create a new app password while the overall app-password feature was disabled. The page already had the main toggle, but it was easy to miss, which could leave users with a newly created password that would not work.

Solution

This change surfaces a clear warning directly in the New App Password section whenever is_app_pass_enabled is false. That places the warning at the point where the user is about to create a password, which matches the issue report without changing the underlying toggle behavior.

Testing

• ./node_modules/.bin/eslint src/app/account-security/app-passwords.component.ts src/app/account-security/app-passwords.component.html src/app/account-security/app-passwords.component.spec.ts
• ./node_modules/.bin/tsc -p tsconfig.json --noEmit
• npm run build
• attempted ./node_modules/.bin/ng test --watch=false --browsers=FirefoxHeadless --include src/app/account-security/app-passwords.component.spec.ts but the environment does not have a Firefox binary installed for Karma (No binary for FirefoxHeadless browser on your platform)

Closes #1537