账户: 修改密码接口 + 账户设置页

- 后端 POST /auth/password: 校验旧密码(argon2id)后重哈希更新
- 前端 /console/settings 账户设置页: 个人资料卡 + 修改密码表单

Co-Authored-By: Claude <noreply@anthropic.com>

server/internal/api/auth.go

@@ -158,6 +158,36 @@ func (h *Handler) Logout(c *gin.Context) {
 	resp.OK(c, gin.H{"ok": true})
 }
 
+type changePasswordReq struct {
+	OldPassword string `json:"old_password" binding:"required"`
+	NewPassword string `json:"new_password" binding:"required,min=8,max=72"`
+}
+
+// ChangePassword POST /api/v1/auth/password — 修改密码。
+func (h *Handler) ChangePassword(c *gin.Context) {
+	u := sessionUser(c)
+	var req changePasswordReq
+	if err := c.ShouldBindJSON(&req); err != nil {
+		resp.Fail(c, http.StatusBadRequest, "invalid input: "+err.Error())
+		return
+	}
+	ok, err := h.a.Hasher.VerifyPassword(u.PasswordHash, req.OldPassword)
+	if err != nil || !ok {
+		resp.Fail(c, http.StatusBadRequest, "旧密码不正确")
+		return
+	}
+	hash, err := h.a.Hasher.HashPassword(req.NewPassword)
+	if err != nil {
+		resp.Fail(c, http.StatusInternalServerError, "failed to hash password")
+		return
+	}
+	if err := h.a.DB.Model(&store.User{}).Where("id = ?", u.ID).Update("password_hash", hash).Error; err != nil {
+		resp.Fail(c, http.StatusInternalServerError, "failed to update password")
+		return
+	}
+	resp.OK(c, gin.H{"ok": true})
+}
+
 // Me GET /api/v1/auth/me
 func (h *Handler) Me(c *gin.Context) {
 	u := sessionUser(c)

server/internal/api/router.go

@@ -63,6 +63,7 @@ func NewRouter(a *app.App, gw *proxy.Gateway) *gin.Engine {
 			auth.POST("/login", h.Login)
 			auth.POST("/refresh", h.Refresh)
 			auth.POST("/logout", h.Logout)
+			auth.POST("/password", middleware.SessionAuth(a), h.ChangePassword)
 			auth.GET("/me", middleware.SessionAuth(a), h.Me)
 		}