fix: allow password change in user settings

[mvanhorn]

Summary

Adds the ability to change your password from user settings. The settings page now shows a password-change form (current + new password) for accounts that have a local password, posts to a new PUT /api/v1/settings/password endpoint that verifies the current password before updating, and hides the form for OAuth-only accounts.

Why this matters

Issue #1321 reports there is no way to change a password in user settings. Accounts created with email/password had no in-app path to rotate their password. This adds the missing flow end to end: a change_password changeset on Codebattle.User that validates the current password against password_hash and applies the new one, a settings_controller action wired at PUT /api/v1/settings/password, and the settings form UI to drive it.

Whether the form appears is driven by a real has_password capability sent in the initial page payload (via AssignGon.prepare_user), so a Firebase/email-password user and a local-password-with-OAuth user each see the correct form on first render, rather than the frontend guessing from linked-provider IDs.

Testing

mix test on the settings controller and the AssignGon plug — 11 tests pass, covering a correct current password, a wrong current password (rejected), and the has_password payload for local vs OAuth users. jest UserSettings.test.jsx — 8 tests pass, covering first-render form visibility for local-password, Firebase, and OAuth-linked accounts. mix format --check-formatted and oxfmt --check clean on changed files.

Fixes #1321