Stage 32 — Password Change API

Endpoint:
POST /api/v1/password/

Authentication:
Bearer token required.

JSON body:
{
  "current_password": "...",
  "new_password": "at least 10 characters"
}

Supported account types:
admin, staff, parent, pupil

The endpoint verifies the current password and stores the new password using password_hash(PASSWORD_DEFAULT). Legacy plaintext passwords are accepted for verification and are replaced with a secure hash when the password is changed.

No schema changes are required.
