M5-06 — Password policy and change-password endpoint

[bihius]

Context

The seed script requires 12 characters but there is no change-password flow and no policy beyond length.

To do

• Add POST /auth/change-password requiring current password
• Validate new password against: min length 12, not identical to current, not in a short common-password blocklist
• Log the event in the audit log
• Integration tests

Definition of done

• Endpoint works for authenticated users
• Weak passwords are rejected with a helpful message