feat(account): change your own password on the Account page (milestone 497)

Step #5428 "Account page: change your own password" of milestone 497
"Passwords: change your own, and reset it by email". A Password section
in the page's one form, for local accounts: current, new, again. Blank
keeps the password; a new one signs out every other browser
(sessions_since) and keeps this one. A wrong current password counts
toward the login throttle. Audited as account.password_changed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/integration/test_account_time_zone.py

@@ -76,7 +76,7 @@ def test_the_browser_zone_is_adopted_once_and_the_account_page_changes_it(app):
     assert "times show in <strong>New York</strong> (E" in page               # EDT or EST
     assert '<option value="America/New_York" selected>New York</option>' in page
     assert "/account/time-zone/adopt" not in page                              # nothing left to adopt
-    assert out["save"] == (302, "/account/") and out["after_save"] == "Europe/London"
+    assert out["save"] == (302, "/account/?done=saved") and out["after_save"] == "Europe/London"
     status, body = out["refused"]
     assert status == 400 and "Nowhere is not a time zone Steward knows." in body
     assert out["after_refused"] == "Europe/London" and out["session_tz"] == "Europe/London"