Logged-in users can change their password safely

[Odzen]

Replaces old issue #927.

Problem

Mentor, mentee, partner, support, guest, and hub users should be able to change their password while logged in. Today the app has forgot-password flows, and admins can reset passwords, but there is no clear self-service password-change flow for logged-in users.

Required behavior

• Add a change-password control in the profile/account settings area for eligible account types.
• Require current password or an equivalent reauthentication step before changing the password.
• Update Firebase Auth password.
• Revoke existing sessions/tokens after password change where appropriate.
• Notify the user by email that their password was changed.

Acceptance criteria

• User can submit current password, new password, and confirmation.
• Invalid current password and weak new password show persistent, visible errors.
• Successful password change signs out other sessions or clearly follows the selected session policy.
• The user receives a password-changed notification email.
• Flow works for all supported roles or documents exceptions.