feat: add PATCH /auth/change-password endpoint

[rubenxyz]

What this adds

PATCH /auth/change-password endpoint so authenticated users can change their own password. The frontend was already coded to call this endpoint but it did not exist.

Changes

1. schemas/auth.py — Adds ChangePasswordRequest schema with current_password and new_password fields.

2. routers/auth.py — Adds PATCH /auth/change-password endpoint. Validates the current password, then hashes and stores the new one. Returns an error if the current password is incorrect.

Files changed

• apps/api/schemas/auth.py — +4 lines
• apps/api/routers/auth.py — +15 lines

[ravirajsinh45]

Hi @rubenxyz — thanks for adding this! An adversarial code review flagged one edge case worth handling before merge (verified against the branch head):

🟡 Medium — HTTP 500 for password-less (magic-code) users. A user who signed in via the magic-code flow and never called /auth/set-password has password_hash = None but is fully authenticated. When they submit the change-password form, change_password calls verify_password(body.current_password, None) → None.encode('utf-8') raises AttributeError, which isn't caught by the surrounding except ValueError, so FastAPI returns 500 (opaque server error) instead of a clean 4xx. The existing /auth/login endpoint already guards this exact case with or not user.password_hash.

Suggested fix: guard before verifying — if current_user.password_hash is None: raise HTTPException(status_code=400, detail="No password set for this account; use set-password instead").

[ravirajsinh45]

Requesting changes: change_password returns HTTP 500 for magic-code users who never set a password (verify_password(current, None) → uncaught AttributeError). A password_hash is None guard (as /auth/login already does) resolves it. Details in the review comment above.