Change Password

A signed-in operator changing their own password. Cognito verifies current_password against the caller's access token, so this can only ever change the caller's own password — no target is (or can be) named.

A minimal human-readable acknowledgement for endpoints that intentionally return no data (e.g. the password-reset flow, which stays non-enumerating — the same message is returned whether or not the account exists).