feat: settings page exercises the password-change endpoint

The 0.10.0 backend endpoint had no UI caller — the audit flagged it
as either-ship-a-form-or-remove-the-endpoint dead code. Shipping the
form, plus the bearer-token-keeps-working regression test the audit
asked for to pin the docstring contract.

Backend:
- New test change_password_via_bearer_leaves_bearer_working asserts
  that PATCH /me/password called with Authorization: Bearer wipes
  cookie sessions but leaves the bearer (api_token) intact and usable
  — matches the docstring claim that bot tokens are opt-in to revoke.

Frontend:
- lib/api/auth.ts: new changePassword(input) wrapping PATCH
  /v1/auth/me/password. Vitest covers happy 204, 401 unauthenticated
  (wrong current), 400 invalid_input (weak new) — same envelope
  parsing shape used elsewhere.
- routes/settings/+page.svelte: minimal form with current /
  new / confirm fields, derived passwordsMatch + canSubmit guards
  (submit stays disabled until current is filled, new is ≥8 chars,
  new == confirm). Shows the API's message inline on failure.
  Documents the "other devices signed out, bot tokens stay" UX in a
  short hint.
- routes/+layout.svelte: new "Settings" link in the session-aware
  nav (between username and Logout) for authed users only.
- e2e/settings.spec.ts (5 cases): nav link reaches the form,
  successful change shows confirmation + clears the form, 401
  surfaces inline, password mismatch keeps submit disabled, anonymous
  user gets a sign-in prompt instead of the form.

Lockstep version bump to 0.11.0.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

frontend/src/routes/+layout.svelte

@@ -34,6 +34,7 @@
             <span data-testid="session-loading" aria-busy="true">…</span>
         {:else if session.user}
             <span data-testid="session-user">{session.user.username}</span>
+            <a href="/settings" data-testid="nav-settings">Settings</a>
             <button type="button" onclick={handleLogout} disabled={loggingOut}>
                 {loggingOut ? 'Logging out…' : 'Logout'}
             </button>

frontend/src/routes/settings/+page.svelte

@@ -0,0 +1,160 @@
+<script lang="ts">
+    import { goto } from '$app/navigation';
+    import { changePassword } from '$lib/api/auth';
+    import { ApiError } from '$lib/api/client';
+    import { session } from '$lib/session.svelte';
+
+    let currentPassword = $state('');
+    let newPassword = $state('');
+    let confirmPassword = $state('');
+    let submitting = $state(false);
+    let success = $state<string | null>(null);
+    let error: string | null = $state(null);
+
+    const passwordsMatch = $derived(
+        newPassword.length > 0 && newPassword === confirmPassword
+    );
+    const canSubmit = $derived(
+        Boolean(session.user) &&
+            currentPassword.length > 0 &&
+            newPassword.length >= 8 &&
+            passwordsMatch &&
+            !submitting
+    );
+
+    async function submit(e: SubmitEvent) {
+        e.preventDefault();
+        if (!canSubmit) return;
+        submitting = true;
+        success = null;
+        error = null;
+        try {
+            await changePassword({
+                current_password: currentPassword,
+                new_password: newPassword
+            });
+            success = 'Password updated. Other devices have been signed out.';
+            currentPassword = '';
+            newPassword = '';
+            confirmPassword = '';
+        } catch (e) {
+            if (e instanceof ApiError && e.status === 401 && !session.user) {
+                // The CurrentUser extractor rejected us — session must
+                // have been wiped externally. Bounce to login.
+                await goto('/login');
+                return;
+            }
+            error = e instanceof Error ? e.message : String(e);
+        } finally {
+            submitting = false;
+        }
+    }
+</script>
+
+<svelte:head>
+    <title>Settings — Mangalord</title>
+</svelte:head>
+
+<h1>Settings</h1>
+
+{#if !session.loaded}
+    <p data-testid="settings-loading">Loading…</p>
+{:else if !session.user}
+    <p data-testid="settings-signin">
+        <a href="/login">Sign in</a> to change your password.
+    </p>
+{:else}
+    <section class="card">
+        <h2>Change password</h2>
+        <p class="hint">
+            Changing your password signs out every other device using this account.
+            Bot API tokens keep working — revoke them individually from the bot-token
+            list if you want to invalidate them too.
+        </p>
+        <form onsubmit={submit} action="javascript:void(0)" data-testid="password-form">
+            <label>
+                Current password
+                <input
+                    type="password"
+                    bind:value={currentPassword}
+                    autocomplete="current-password"
+                    required
+                    data-testid="current-password"
+                />
+            </label>
+            <label>
+                New password
+                <input
+                    type="password"
+                    bind:value={newPassword}
+                    autocomplete="new-password"
+                    minlength="8"
+                    required
+                    data-testid="new-password"
+                />
+            </label>
+            <label>
+                Confirm new password
+                <input
+                    type="password"
+                    bind:value={confirmPassword}
+                    autocomplete="new-password"
+                    minlength="8"
+                    required
+                    data-testid="confirm-password"
+                />
+                {#if confirmPassword.length > 0 && !passwordsMatch}
+                    <span class="field-error" role="alert" data-testid="mismatch">
+                        Passwords don't match.
+                    </span>
+                {/if}
+            </label>
+            <button
+                type="submit"
+                disabled={!canSubmit}
+                data-testid="password-submit"
+            >
+                {submitting ? 'Updating…' : 'Update password'}
+            </button>
+            {#if success}
+                <p class="success" data-testid="password-success">{success}</p>
+            {/if}
+            {#if error}
+                <p role="alert" class="form-error" data-testid="password-error">{error}</p>
+            {/if}
+        </form>
+    </section>
+{/if}
+
+<style>
+    .card {
+        border: 1px solid #ddd;
+        border-radius: 6px;
+        padding: 1rem;
+        max-width: 32rem;
+    }
+    .hint {
+        color: #555;
+        font-size: 0.95rem;
+    }
+    form {
+        display: flex;
+        flex-direction: column;
+        gap: 0.75rem;
+    }
+    label {
+        display: flex;
+        flex-direction: column;
+        gap: 0.25rem;
+    }
+    .field-error {
+        color: #b00020;
+        font-size: 0.9rem;
+    }
+    .form-error {
+        color: #b00020;
+    }
+    .success {
+        color: #0a7d2c;
+    }
+</style>