Whether this account has a password its owner can change.

The settings row needs to say either "Change password" or "Set a password" BEFORE the user taps it, and the frontend cannot work that out on its own: an OAuth account's hashed_password is non-empty (it holds the literal oauth:{provider}:{id}), so the existing has_password field on /account-status reads true for exactly the accounts that have none.