Add admin password change flow (closes #65) (#83)

Adds an authenticated, CSRF-protected flow that lets a user change their own password from the profile page.

## Route

- New `POST /password` under the `/user/{username}` group in `setupUserRoutes` (`internal/server/routes.go`). That group already applies `CSRF`, `NoCache`, and `RequireAuth`, so the new endpoint inherits all three.

## Handler (`internal/handlers/profile.go`)

- `HandlePasswordChange` enforces own-user access: the `{username}` path parameter must equal the session username (same 403 rule `HandleProfile` uses). This check plus the session lookup is factored into a shared `profileOwnerOrDeny` helper now used by both handlers.
- Parses `current_password`, `new_password`, and `confirm_password` (body size limited via `http.MaxBytesReader`).
- Verifies the current password with `database.VerifyPassword` against the stored hash.
- Requires the new password to be non-empty and equal to the confirmation.
- Hashes the new password with `database.HashPassword` — the same Argon2id helper used to bootstrap the admin user — and persists it on the user row. No new crypto.
- Re-renders the profile page with a clear success or error message. Wrong current password, empty new password, and mismatched confirmation are each rejected with their own message and leave the stored hash unchanged.

## Template (`templates/profile.html`)

- Adds a "Change Password" card with current / new / confirm password fields plus the hidden `csrf_token` (matching the login form's CSRF embedding).
- Renders success/error alerts using the existing `alert-success` / `alert-error` styles. No new CSS classes, so no Tailwind rebuild is required.

## Tests (`internal/handlers/profile_test.go`)

- `TestHandlePasswordChange_Success`: seeds a user, posts a valid change, asserts success message and that the stored hash changed and verifies against the new password.
- `TestHandlePasswordChange_WrongCurrentPassword`: posts a wrong current password, asserts the rejection message and that the stored hash is unchanged.

Validated with `docker build .` (fmt-check, lint, test, build) — exit 0.

Closes #65

Co-authored-by: sneak <sneak@sneak.berlin>
Co-authored-by: Jeffrey Paul <sneak@noreply.example.org>
Reviewed-on: #83
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

internal/middleware/ratelimit_test.go

@@ -46,14 +46,20 @@ func TestLoginRateLimit_AllowsGET(t *testing.T) {
 	assert.Equal(t, 20, callCount)
 }
 
-func TestLoginRateLimit_LimitsPOST(t *testing.T) {
-	t.Parallel()
-
-	m, _ := testMiddleware(t, config.EnvironmentDev)
+// runPostLimitTest exercises a POST-only rate limit middleware:
+// the first limit POSTs to path from ip must pass, and the next
+// one must be rejected with 429 without reaching the handler.
+func runPostLimitTest(
+	t *testing.T,
+	mw func(http.Handler) http.Handler,
+	limit int,
+	path, ip string,
+) {
+	t.Helper()
 
 	var callCount int
 
-	handler := m.LoginRateLimit()(http.HandlerFunc(
+	handler := mw(http.HandlerFunc(
 		func(w http.ResponseWriter, _ *http.Request) {
 			callCount++
 
@@ -61,13 +67,13 @@ func TestLoginRateLimit_LimitsPOST(t *testing.T) {
 		},
 	))
 
-	// First loginRateLimit POST requests should succeed
-	for i := range middleware.LoginRateLimitConst {
+	// The first limit POST requests should succeed
+	for i := range limit {
 		req := httptest.NewRequestWithContext(
 			context.Background(),
-			http.MethodPost, "/pages/login", nil,
+			http.MethodPost, path, nil,
 		)
-		req.RemoteAddr = "10.0.0.1:12345"
+		req.RemoteAddr = ip
 
 		w := httptest.NewRecorder()
 		handler.ServeHTTP(w, req)
@@ -81,9 +87,9 @@ func TestLoginRateLimit_LimitsPOST(t *testing.T) {
 	// Next POST should be rate-limited
 	req := httptest.NewRequestWithContext(
 		context.Background(),
-		http.MethodPost, "/pages/login", nil,
+		http.MethodPost, path, nil,
 	)
-	req.RemoteAddr = "10.0.0.1:12345"
+	req.RemoteAddr = ip
 
 	w := httptest.NewRecorder()
 	handler.ServeHTTP(w, req)
@@ -92,7 +98,35 @@ func TestLoginRateLimit_LimitsPOST(t *testing.T) {
 		t, http.StatusTooManyRequests, w.Code,
 		"POST after limit should be 429",
 	)
-	assert.Equal(t, middleware.LoginRateLimitConst, callCount)
+	assert.Equal(t, limit, callCount)
+}
+
+func TestLoginRateLimit_LimitsPOST(t *testing.T) {
+	t.Parallel()
+
+	m, _ := testMiddleware(t, config.EnvironmentDev)
+
+	runPostLimitTest(
+		t,
+		m.LoginRateLimit(),
+		middleware.LoginRateLimitConst,
+		"/pages/login",
+		"10.0.0.1:12345",
+	)
+}
+
+func TestPasswordChangeRateLimit_LimitsPOST(t *testing.T) {
+	t.Parallel()
+
+	m, _ := testMiddleware(t, config.EnvironmentDev)
+
+	runPostLimitTest(
+		t,
+		m.PasswordChangeRateLimit(),
+		middleware.PasswordChangeRateLimitConst,
+		"/user/admin/password",
+		"10.0.0.2:12345",
+	)
 }
 
 func TestLoginRateLimit_IndependentPerIP(t *testing.T) {