Enforce the full user-management RBAC matrix, add self-service password change

api/localauth now enforces every rule of the requested matrix, each
checked inside the handler beyond RegisterRoutes' floor:
  - At least one owner must always exist -- handleDeleteUser and
    handleSetRole both refuse an operation that would leave zero
    owners (wouldRemoveLastOwner, backed by new store method
    CountUsersWithRole), whether the caller is admin or owner.
  - Owner can create/delete any role, including another owner (subject
    to the above). Admin can only create/delete viewer or editor --
    GET/POST /auth/users and DELETE .../{id} moved from RoleOwner to
    RoleAdmin floor, with an inner check narrowing what an admin
    caller specifically may target.
  - Only a user can change their own password -- new POST
    /auth/password (RoleViewer floor, i.e. every role) requires the
    caller's current password (verified via new store method
    GetPasswordHashByID) and is now the only path to changing your
    own, including for an owner. The existing admin-reset endpoint
    (POST /auth/users/{id}/reset-password, also moved to RoleAdmin
    floor) now refuses id == the caller's own ID, and refuses an
    owner target unless the caller is themselves an owner -- "admin
    can change any password except an owner's; owner can change any
    password, even another owner's."
  - Role reassignment (PUT .../{id}/role) stays owner-only, unchanged
    beyond the last-owner guard above.

New web/src/routes/account page (linked from NavSidebar next to "Log
out", visible to every local-auth role) is the self-service password
change UI. /users now mirrors the server's per-row restrictions
client-side (disabled role selects/delete/reset buttons with an
explanatory title, a restricted role list on the create form) so an
admin never sees an action that would just 403 -- the server remains
the actual authority.

Verified live against real Postgres and in the browser: the full
matrix via curl (owner creating a second owner, admin blocked from
creating/deleting/resetting admin or owner accounts, last-owner delete
and demote both blocked, admin resetting non-owner passwords,
self-target reset rejected, self-service change with wrong/right
current password), plus the actual /users page rendering correctly
restricted for an admin session and a full change-password round trip
through the real UI ending in a forced re-login with the new password.

api/localauth/store_integration_test.go

@@ -221,3 +221,67 @@ func TestIntegrationSetRoleAcceptsEveryRole(t *testing.T) {
 		}
 	}
 }
+
+// TestIntegrationCountUsersWithRole confirms the count reflects real
+// inserts/role changes against the actual tenant_memberships table --
+// the "at least one owner" guard this backs (handler.go's
+// wouldRemoveLastOwner) is only as trustworthy as this query.
+func TestIntegrationCountUsersWithRole(t *testing.T) {
+	store := integrationStore(t)
+	ctx := context.Background()
+	username := testUsername(t)
+
+	hash, _ := HashPassword("password1")
+	user, err := store.CreateUser(ctx, username, hash, authz.RoleOwner)
+	if err != nil {
+		t.Fatalf("CreateUser: %v", err)
+	}
+	t.Cleanup(func() { _ = store.DeleteUser(ctx, user.ID) })
+
+	before, err := store.CountUsersWithRole(ctx, authz.RoleOwner)
+	if err != nil {
+		t.Fatalf("CountUsersWithRole(owner): %v", err)
+	}
+	if before < 1 {
+		t.Fatalf("owner count = %d, want at least 1 (the user just created)", before)
+	}
+
+	if err := store.SetRole(ctx, user.ID, authz.RoleAdmin); err != nil {
+		t.Fatalf("SetRole: %v", err)
+	}
+	after, err := store.CountUsersWithRole(ctx, authz.RoleOwner)
+	if err != nil {
+		t.Fatalf("CountUsersWithRole(owner) after demotion: %v", err)
+	}
+	if after != before-1 {
+		t.Fatalf("owner count after demoting one = %d, want %d", after, before-1)
+	}
+}
+
+// TestIntegrationGetPasswordHashByID confirms it reads the same hash
+// GetUserForLogin does, by ID instead of username -- the self-service
+// password change handler's only way to fetch the caller's own hash.
+func TestIntegrationGetPasswordHashByID(t *testing.T) {
+	store := integrationStore(t)
+	ctx := context.Background()
+	username := testUsername(t)
+
+	hash, _ := HashPassword("correct horse battery staple")
+	user, err := store.CreateUser(ctx, username, hash, authz.RoleViewer)
+	if err != nil {
+		t.Fatalf("CreateUser: %v", err)
+	}
+	t.Cleanup(func() { _ = store.DeleteUser(ctx, user.ID) })
+
+	got, err := store.GetPasswordHashByID(ctx, user.ID)
+	if err != nil {
+		t.Fatalf("GetPasswordHashByID: %v", err)
+	}
+	if !ComparePassword(got, "correct horse battery staple") {
+		t.Errorf("hash from GetPasswordHashByID does not verify against the original password")
+	}
+
+	if _, err := store.GetPasswordHashByID(ctx, uuid.NewString()); !errors.Is(err, ErrNotFound) {
+		t.Errorf("GetPasswordHashByID for an unknown ID: err = %v, want ErrNotFound", err)
+	}
+}