bug(settings): an SSO account is offered a Change password form it cannot use #850

Problem

A user who signs in through an identity provider has no password in OpenRisk. Settings › Security still shows them the Change password card (frontend/src/features/auth/ChangePasswordCard.tsx, mounted in SettingsScreen.tsx) with a "current password" field they can't fill. They only find out after typing something and submitting, when the server answers 409 no_local_password and the card switches to a "managed by your identity provider" message (setManagedByIdp).

That's a dead end: a form that can't succeed, a password prompt that looks like a phishing pattern to a careful user, and a failed request logged against their account.

GET /auth/me has returned has_password since #754 (PR #848), so the client can know this before rendering anything.

Acceptance criteria

1. When /auth/me says has_password: false, the card shows no password fields. It explains, in FR and EN, that the password is managed by the identity provider, reusing the existing managedByIdp message.
2. When has_password is true, the card is unchanged.
3. While /auth/me is loading, the card shows a skeleton, not the form. If the read fails, the card falls back to today's form: the server's 409 still switches it to the message, so nothing gets worse.
4. The account-security i18n keys stay at FR/EN parity.
5. Tests: the card renders the message and no fields for has_password: false; the form for true; the form plus the 409 fallback when the read fails.

Definition of Done

• Criteria met; vitest, tsc and eslint green on the touched files.
• A live pass in a real browser with an SSO-style account (no local password) and a password account, in both themes.