security: require password confirmation for sensitive account actions

[eugenioenko]

Summary

Closes #180

• TOTP setup, passkey registration, and passkey deletion now require current_password in the request body
• Email and username changes require current_password when the value actually changes (non-sensitive fields like name, phone, etc. do not)
• Email change resets is_email_verified to false, so the next login forces re-verification when RequireEmailVerification is enabled
• Passkey-only users (no password set) skip the password check gracefully — the security boundary is their authenticated session
• Account UI shows a password prompt modal before sensitive actions via a new reusable PasswordPrompt component

Breaking change for API consumers

The following account API endpoints now require a current_password field in the JSON request body:

Endpoint	When required
PUT /account/api/profile	When email or username is changing
POST /account/api/mfa/totp/setup	Always
POST /account/api/passkeys/register/begin	Always
DELETE /account/api/passkeys/{id}	Always

Test plan

• Unit tests: password required for email change, username change, TOTP setup, passkey add/delete
• Unit tests: wrong password returns 403
• Unit tests: passkey-only users (empty password) can still perform actions
• Unit tests: non-sensitive fields (given_name, etc.) do not require password
• Unit tests: email change resets is_email_verified
• Unit tests: same email/username does not trigger password prompt
• Security tests: IDOR test updated and passing
• E2E tests passing
• Frontend builds successfully
• Manual test: profile page password prompt on email/username change
• Manual test: TOTP setup password step
• Manual test: passkey add/delete password prompt

🤖 Generated with Claude Code