Users — self-service password change for the signed-in user (API + SPA) #166

Parent issue

Reported during QA session.

What's wrong

A signed-in user has no way to change their own password. There is no profile or account screen, and no endpoint for it — whatever password the Admin picked at creation is permanent.

What I expected

Any signed-in user (any role) can change their own password by entering their current password and a new one.

Steps to reproduce

1. Log in as any user.
2. Look for a profile/account/password option anywhere in the app — none exists.

Blocked by

None — can start immediately.

Additional context

Distinct from #165 (admin sets a password): self-service must verify the current password and works for every role, while the admin path is Admin (owner)-gated and does not. The new-password rules should match the create-user dialog (min 12 chars). Needs a small "account" surface in the SPA (e.g. a menu entry) since none exists today.