0.2.39: bitcoin-denominated view, first-login flow, unfunded + tax center

- BTC prices: btc_prices table, CSV upload on Import page (auto-detected
  date/close columns, upsert by date), entities.close_date as the BTC entry
  mark; statements carry btc_price_cents (as-of) + btc_close_price_cents.
  LP capital blocks show paid-in vs current value in bitcoin terms.
- First login: accounts on the shared default password are flagged
  (must_change_password) and blocked behind a full-screen password change;
  external accounts then get a one-time welcome tour with a 2FA offer
  (users.onboarded_at).
- LP portal: Unfunded (callable commitment) metric; Tax documents center
  aggregating K-1/tax docs across funds, grouped by year.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/ten31portal/routers/auth_router.py

@@ -3,6 +3,7 @@
 import os
 import secrets
 import time
+from datetime import datetime
 
 from fastapi import APIRouter, Depends, HTTPException, Request
 from sqlmodel import Session, select
@@ -78,6 +79,13 @@ def login(
         raise HTTPException(status_code=401, detail="This account does not have a login yet.")
     if not user.is_active:
         raise HTTPException(status_code=401, detail="Account disabled")
+    # Anyone still signing in with the shared default password gets flagged so the portal
+    # forces them to set their own before doing anything else (covers accounts created
+    # before the flag existed).
+    if body.password == config.DEFAULT_INVESTOR_PASSWORD and not user.must_change_password:
+        user.must_change_password = True
+        session.add(user)
+        session.commit()
     if user.totp_enabled:
         # Password accepted, but don't sign the session in yet — park the login until
         # /login/verify-totp confirms the second factor.
@@ -155,7 +163,10 @@ def change_password(
         raise HTTPException(status_code=400, detail="Current password is incorrect.")
     if len(body.new_password) < 8:
         raise HTTPException(status_code=400, detail="New password must be at least 8 characters.")
+    if body.new_password == config.DEFAULT_INVESTOR_PASSWORD:
+        raise HTTPException(status_code=400, detail="Please choose a password of your own.")
     user.password_hash = hash_password(body.new_password)
+    user.must_change_password = False
     session.add(user)
     session.commit()
     # Once the built-in admin sets their own password, the initial one from first boot is stale.
@@ -167,6 +178,19 @@ def change_password(
     return {"status": "ok"}
 
 
+@router.post("/onboarded")
+def mark_onboarded(
+    user: User = Depends(get_current_user),
+    session: Session = Depends(get_session),
+) -> dict[str, str]:
+    """Stamp the first-login welcome flow as finished (or skipped) so it stops showing."""
+    if user.onboarded_at is None:
+        user.onboarded_at = datetime.utcnow()
+        session.add(user)
+        session.commit()
+    return {"status": "ok"}
+
+
 # --- Two-factor enrollment (per-user opt-in) ---
 
 @router.post("/totp/setup")