feat: self-service change password for all roles

- middleware.ts: add /account to isSharedRoute so all roles can reach it
- components/account/change-password-form.tsx: re-auth with current password
  then updateUser({password}) with client-side validation (length, match, diff)
- app/(protected)/account/page.tsx: dedicated account page, no role gate
- sidebar.tsx: Account link (all roles) above Logout in desktop footer

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CPf5Rc8QPx6V8KLEEgfKEQ

app/(protected)/account/page.tsx

@@ -0,0 +1,13 @@
+import ChangePasswordForm from '@/components/account/change-password-form'
+
+export const metadata = { title: 'Account' }
+
+export default function AccountPage() {
+  return (
+    <main className="max-w-2xl mx-auto px-4 py-6">
+      <h1 className="text-2xl font-bold text-gray-900 mb-2">Account</h1>
+      <p className="text-sm text-gray-500 mb-6">Manage your password.</p>
+      <ChangePasswordForm />
+    </main>
+  )
+}