feat: add admin password change via /settings page

Backend:
- DB: add UpdateAdminPasswordHash(id, hash) in queries_users.go
- Auth: add ChangePassword(username, old, new) method that verifies
  old password, validates length >= 8, and stores bcrypt hash
- Handlers: add handleChangePassword on PUT /api/auth/password (auth required)
- Router: register route inside protected group

Frontend:
- api.ts: add changePassword(oldPassword, newPassword)
- Settings.tsx: new page with form (current + new + confirm), client-side
  validation, success/error feedback
- App.tsx: add /settings route
- Layout.tsx: add 'Ajustes' nav item

internal/db/queries_users.go

@@ -238,6 +238,24 @@ func (d *DB) CreateAdmin(username, passwordHash string) (Admin, error) {
 	return d.GetAdminByUsername(username)
 }
 
+func (d *DB) UpdateAdminPasswordHash(id int64, hash string) error {
+	result, err := d.conn.Exec(
+		`UPDATE admins SET password_hash = ?, updated_at = datetime('now') WHERE id = ?`,
+		hash, id,
+	)
+	if err != nil {
+		return fmt.Errorf("update admin password: %w", err)
+	}
+	rows, err := result.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("rows affected: %w", err)
+	}
+	if rows == 0 {
+		return fmt.Errorf("admin not found")
+	}
+	return nil
+}
+
 func (d *DB) GetSetting(key string) (string, bool, error) {
 	var value string
 	err := d.conn.QueryRow(`SELECT value FROM settings WHERE key = ?`, key).Scan(&value)