Change Password Endpoint

Change the Portal password, from either an initial or a full session.

This and POST /logout are the only authenticated endpoints reachable while the session's mode is "initial" -- :func:~palmimo_portal.api.deps.require_full_session, applied everywhere else, is deliberately not applied here.

• From an initial session: no current_password check -- auth.json is created for the first time (:func:~palmimo_portal.core.auth.change_password_from_initial, same exclusive-create machinery as POST /setup, so two concurrent requests from two initial sessions cannot both win). The login rate limiter is not touched on this path: an initial session already proved sticker-password knowledge at login, the sticker password crosses the same plain-HTTP LAN hop either way, and this endpoint is the only action an initial session can take -- re-verifying here would only let a stolen initial-mode cookie burn the shared login budget.
• From a full session: current_password checks against the stored hash and shares :class:~palmimo_portal.core.auth.LoginRateLimiter with POST /login (same instance, budget, lockout) -- a stolen full session cookie must not hand an attacker an unlimited oracle to brute-force the current password; auth.json is rotated in place (:func:~palmimo_portal.core.auth.change_password_from_full).

Either way a fresh full-mode session is issued, so the caller need not log in again -- required for the initial-to-full transition, since Wi-Fi endpoints are session-gated even while unprovisioned on an identity-carrying device (see :func:~palmimo_portal.api.deps.require_wifi_access).

Raises: PortalError: 409 auth_state_corrupt if auth.json is corrupt, or (initial session only) if the identity file backing the session has since disappeared; 503 identity_unavailable if the identity file could not be read (initial session only); 409 auth_change_conflict if a concurrent change from another initial session already won the race to create auth.json (initial session only); 401 invalid_current_password (full session only) if current_password is missing or wrong -- checked before try_attempt() when missing, so a malformed request doesn't spend budget; 429 auth_rate_limited while locked out (full session only); 409 auth_not_set (full session only) if auth.json is deleted between the mode check and the verify call running (a race, not reachable from a normal request); 409 auth_change_in_progress (full session only) if a concurrent full-mode change is already holding :meth:~palmimo_portal.ports.StateStore.lock_auth past its timeout.