feat(account): change your own password on the Account page (milestone 497)

Step #5428 "Account page: change your own password" of milestone 497
"Passwords: change your own, and reset it by email". A Password section
in the page's one form, for local accounts: current, new, again. Blank
keeps the password; a new one signs out every other browser
(sessions_since) and keeps this one. A wrong current password counts
toward the login throttle. Audited as account.password_changed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/audit/service.py

@@ -120,6 +120,9 @@ ACTIONS = {
     "auth.setup": "set up Steward",
     "account.time_zone": "set their time zone",
     "account.email": "changed their email settings",
+    "account.password_changed": "changed their password",
+    "user.password_reset_requested": "asked for a password reset email",
+    "user.password_reset_by_email": "reset their password from an emailed link",
     "user.created": "added user",
     "user.renamed": "renamed user",
     "user.role_changed": "changed the role of user",