fix(auth): restore password settings access

[dongmucat]

Summary

Fixes #541.

Restore the password settings flow by exposing a backend-authoritative canChangePassword capability and using it in the settings UI so local-password users can reach the security page while OAuth-only users see an unavailable state.

Changes

• Add canChangePassword to auth responses based on local credential existence.
• Keep password-change enforcement on the backend unchanged.
• Update generated API schema and frontend settings/security rendering.
• Cover local-password and OAuth-only flows with backend, frontend, and E2E tests.

Verification

• Backend tests passed.
• Web build/test passed.
• Real-services E2E passed on the same commit before PR replacement; checks will re-run on this PR.

Merge note

No merge into main was performed.