phsl / new-api

Pin down the checkUpdatePassword contract:

- changing a password requires the correct current password
- OAuth/passwordless accounts (empty password hash) cannot set a
  password through the self-service endpoint and must use the password
  reset flow instead
- setupLogin never writes back the password column

These guard against regressing the password-change path back into a
short-circuit that lets passwordless accounts set a password directly.