feat(F4): PIN verification on arm/disarm + reset-pin endpoint

Adds PIN checking to arm/disarm endpoints using verify_pin() against
cfg.security.pin_hash, and a new POST /system/api/reset-pin endpoint
that verifies the recovery passphrase before updating the PIN hash.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

vigilar/web/blueprints/system.py

@@ -4,6 +4,7 @@ import os
 
 from flask import Blueprint, current_app, jsonify, render_template, request
 
+from vigilar.alerts.pin import hash_pin, verify_pin
 from vigilar.config import VigilarConfig
 from vigilar.config_writer import (
     save_config,
@@ -58,7 +59,10 @@ def arm_system():
     data = request.get_json() or {}
     mode = data.get("mode", "ARMED_AWAY")
     pin = data.get("pin", "")
-    # TODO: verify PIN against config hash
+    cfg = _get_cfg()
+    pin_hash = cfg.security.pin_hash
+    if pin_hash and not verify_pin(pin, pin_hash):
+        return jsonify({"error": "Invalid PIN"}), 401
     return jsonify({"ok": True, "state": mode})
 
 
@@ -66,10 +70,30 @@ def arm_system():
 def disarm_system():
     data = request.get_json() or {}
     pin = data.get("pin", "")
-    # TODO: verify PIN
+    cfg = _get_cfg()
+    pin_hash = cfg.security.pin_hash
+    if pin_hash and not verify_pin(pin, pin_hash):
+        return jsonify({"error": "Invalid PIN"}), 401
     return jsonify({"ok": True, "state": "DISARMED"})
 
 
+@system_bp.route("/api/reset-pin", methods=["POST"])
+def reset_pin():
+    data = request.get_json() or {}
+    recovery_passphrase = data.get("recovery_passphrase", "")
+    new_pin = data.get("new_pin", "")
+    cfg = _get_cfg()
+    if not verify_pin(recovery_passphrase, cfg.security.recovery_passphrase_hash):
+        return jsonify({"error": "Invalid recovery passphrase"}), 401
+    new_security = cfg.security.model_copy(update={"pin_hash": hash_pin(new_pin)})
+    new_cfg = cfg.model_copy(update={"security": new_security})
+    try:
+        _save_and_reload(new_cfg)
+    except Exception:
+        current_app.config["VIGILAR_CONFIG"] = new_cfg
+    return jsonify({"ok": True})
+
+
 # --- Config Read API ---
 
 @system_bp.route("/api/config")