feat: add admin password change via /settings page

Backend:
- DB: add UpdateAdminPasswordHash(id, hash) in queries_users.go
- Auth: add ChangePassword(username, old, new) method that verifies
  old password, validates length >= 8, and stores bcrypt hash
- Handlers: add handleChangePassword on PUT /api/auth/password (auth required)
- Router: register route inside protected group

Frontend:
- api.ts: add changePassword(oldPassword, newPassword)
- Settings.tsx: new page with form (current + new + confirm), client-side
  validation, success/error feedback
- App.tsx: add /settings route
- Layout.tsx: add 'Ajustes' nav item

internal/web/router.go

@@ -29,6 +29,7 @@ func NewRouter(s *Server) chi.Router {
 			protected.Post("/apply", s.handleApply)
 			protected.Get("/apply/log", s.handleApplyLog)
 			protected.Get("/system/status", s.handleSystemStatus)
+			protected.Put("/auth/password", s.handleChangePassword)
 
 			protected.Get("/import/status", s.handleImportStatus)
 			protected.Post("/import/samba", s.handleImportSamba)