Add admin password change flow (closes #65) (#83)

Adds an authenticated, CSRF-protected flow that lets a user change their own password from the profile page.

## Route

- New `POST /password` under the `/user/{username}` group in `setupUserRoutes` (`internal/server/routes.go`). That group already applies `CSRF`, `NoCache`, and `RequireAuth`, so the new endpoint inherits all three.

## Handler (`internal/handlers/profile.go`)

- `HandlePasswordChange` enforces own-user access: the `{username}` path parameter must equal the session username (same 403 rule `HandleProfile` uses). This check plus the session lookup is factored into a shared `profileOwnerOrDeny` helper now used by both handlers.
- Parses `current_password`, `new_password`, and `confirm_password` (body size limited via `http.MaxBytesReader`).
- Verifies the current password with `database.VerifyPassword` against the stored hash.
- Requires the new password to be non-empty and equal to the confirmation.
- Hashes the new password with `database.HashPassword` — the same Argon2id helper used to bootstrap the admin user — and persists it on the user row. No new crypto.
- Re-renders the profile page with a clear success or error message. Wrong current password, empty new password, and mismatched confirmation are each rejected with their own message and leave the stored hash unchanged.

## Template (`templates/profile.html`)

- Adds a "Change Password" card with current / new / confirm password fields plus the hidden `csrf_token` (matching the login form's CSRF embedding).
- Renders success/error alerts using the existing `alert-success` / `alert-error` styles. No new CSS classes, so no Tailwind rebuild is required.

## Tests (`internal/handlers/profile_test.go`)

- `TestHandlePasswordChange_Success`: seeds a user, posts a valid change, asserts success message and that the stored hash changed and verifies against the new password.
- `TestHandlePasswordChange_WrongCurrentPassword`: posts a wrong current password, asserts the rejection message and that the stored hash is unchanged.

Validated with `docker build .` (fmt-check, lint, test, build) — exit 0.

Closes #65

Co-authored-by: sneak <sneak@sneak.berlin>
Co-authored-by: Jeffrey Paul <sneak@noreply.example.org>
Reviewed-on: #83
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

internal/middleware/ratelimit.go

@@ -14,6 +14,16 @@ const (
 
 	// loginRateInterval is the time window for the rate limit.
 	loginRateInterval = 1 * time.Minute
+
+	// passwordChangeRateLimit is the maximum number of password
+	// change attempts per interval. Each attempt verifies the
+	// current password, so the endpoint must be rate-limited
+	// like any other password-based authentication endpoint.
+	passwordChangeRateLimit = 5
+
+	// passwordChangeRateInterval is the time window for the
+	// password change rate limit.
+	passwordChangeRateInterval = 1 * time.Minute
 )
 
 // LoginRateLimit returns middleware that enforces per-IP rate
@@ -24,19 +34,53 @@ const (
 // honours X-Forwarded-For, X-Real-IP, and True-Client-IP headers
 // for reverse-proxy setups.
 func (m *Middleware) LoginRateLimit() func(http.Handler) http.Handler {
-	limiter := httprate.Limit(
+	return m.postRateLimit(
 		loginRateLimit,
 		loginRateInterval,
+		"login rate limit exceeded",
+		"Too many login attempts. Please try again later.",
+	)
+}
+
+// PasswordChangeRateLimit returns middleware that enforces
+// per-IP rate limiting on password change attempts. The change
+// endpoint verifies the current password, so without a limit a
+// stolen session could be used to brute-force it; the limit
+// matches the login endpoint's.
+func (m *Middleware) PasswordChangeRateLimit() func(http.Handler) http.Handler {
+	return m.postRateLimit(
+		passwordChangeRateLimit,
+		passwordChangeRateInterval,
+		"password change rate limit exceeded",
+		"Too many password change attempts. "+
+			"Please try again later.",
+	)
+}
+
+// postRateLimit builds middleware that enforces a per-IP rate
+// limit on POST requests only; all other methods pass through
+// unaffected. Requests over the limit receive a 429 with the
+// given response message, and each rejection is logged with the
+// given log message. IP extraction honours X-Forwarded-For,
+// X-Real-IP, and True-Client-IP headers for reverse-proxy
+// setups.
+func (m *Middleware) postRateLimit(
+	limit int,
+	interval time.Duration,
+	logMessage, responseMessage string,
+) func(http.Handler) http.Handler {
+	limiter := httprate.Limit(
+		limit,
+		interval,
 		httprate.WithKeyFuncs(httprate.KeyByRealIP),
 		httprate.WithLimitHandler(http.HandlerFunc(
 			func(w http.ResponseWriter, r *http.Request) {
-				m.log.Warn("login rate limit exceeded",
+				m.log.Warn(logMessage,
 					"path", r.URL.Path,
 				)
 				http.Error(
 					w,
-					"Too many login attempts. "+
-						"Please try again later.",
+					responseMessage,
 					http.StatusTooManyRequests,
 				)
 			},
@@ -50,8 +94,7 @@ func (m *Middleware) LoginRateLimit() func(http.Handler) http.Handler {
 			w http.ResponseWriter,
 			r *http.Request,
 		) {
-			// Only rate-limit POST requests (actual login
-			// attempts)
+			// Only rate-limit POST requests.
 			if r.Method != http.MethodPost {
 				next.ServeHTTP(w, r)