feat(auth): add password change endpoint

[saurabhhhcodes]

Summary

• add authenticated PATCH /auth/password for rotating the current user's password
• validate the current password before hashing and saving the new password
• cover OpenAPI exposure, success, incorrect-current-password, and unauthenticated flows in auth route tests

Fixes #953

Validation

• uv run --with-requirements backend/requirements.txt python -m py_compile backend/app/routers/auth.py backend/app/schemas.py backend/tests/test_auth_endpoints.py
• Auth-router smoke test passed for signup -> password change -> old password rejected -> new password accepted
• Note: full backend/tests/test_auth_endpoints.py collection is blocked locally by missing system libmagic from existing upload_file import path: ImportError: failed to find libmagic. Check your installation