fix(auth): keep session on a wrong-current-password 401

The change-password endpoint returns 401 for a wrong *current* password,
the same status the global on401 hook uses to detect an expired session.
The hook fired first and cleared session.user, so the account form's
"still signed in?" guard always saw null and bounced the user to /login
instead of surfacing the error inline.

Add a per-call `suppressOn401` option to `request`; changePassword opts
in, so a 401 there stays inline and the session is left intact.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/lib/api/auth.ts

@@ -58,11 +58,18 @@ export type ChangePassword = {
  * password.
  */
 export async function changePassword(input: ChangePassword): Promise<void> {
-    await request<void>('/v1/auth/me/password', {
-        method: 'PATCH',
-        headers: { 'content-type': 'application/json' },
-        body: JSON.stringify(input)
-    });
+    await request<void>(
+        '/v1/auth/me/password',
+        {
+            method: 'PATCH',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify(input)
+        },
+        // A 401 here means the *current* password was wrong, not that the
+        // session expired — don't let the global hook clear the user and
+        // bounce them to /login; the form surfaces the error inline.
+        { suppressOn401: true }
+    );
 }
 
 /**