Change the logged-in user's password. Session-auth required.

Verifies current_password against the stored hash with the SAME bcrypt + timing discipline as /login (db.verify_user_password — bcrypt.checkpw, dummy hash on the miss path), enforces the signup length rule on new_password, and rejects a no-op (new == current).

On success: rotates the password and REVOKES ALL OTHER sessions — every other device/cookie is logged out so a stolen session dies with the old password — while KEEPING the requesting session alive (the user who just changed their password stays logged in HERE). Returns {"ok": true}.

Failures:

• no/invalid session → 401 (require_session_user)
• wrong current → 403 "Current password is incorrect." (deliberately NOT 401: a bad guess must not make the browser treat the caller as logged out and tear down their session state client-side)
• invalid / no-op new → 422 (the rule, in plain words)
• too many attempts → 429 (per-user brute-force guard on current_password)