ci: fix prisma client resolution in smoke job

Use `pnpm --filter @mcpctl/db exec` to run the CI user setup script
so @prisma/client resolves correctly under pnpm's strict layout.
Also remove unused bcrypt dependency.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -144,23 +144,20 @@ jobs:
 
       - name: Create CI user and session
         run: |
-          node -e "
+          pnpm --filter @mcpctl/db exec node -e "
             const { PrismaClient } = require('@prisma/client');
             const crypto = require('crypto');
-            const bcrypt = require('bcrypt');
             (async () => {
               const prisma = new PrismaClient();
-              const hash = await bcrypt.hash('ci-smoke-test', 10);
               const user = await prisma.user.upsert({
                 where: { email: 'ci@test.local' },
-                create: { email: 'ci@test.local', name: 'CI', passwordHash: hash, role: 'USER' },
-                update: { passwordHash: hash },
+                create: { email: 'ci@test.local', name: 'CI', passwordHash: '!ci-no-login', role: 'USER' },
+                update: {},
               });
               const token = crypto.randomBytes(32).toString('hex');
               await prisma.session.create({
                 data: { token, userId: user.id, expiresAt: new Date(Date.now() + 86400000) },
               });
-              // Grant full RBAC permissions
               await prisma.rbacDefinition.create({
                 data: {
                   name: 'ci-admin',