feat: add admin password change via /settings page

Backend:
- DB: add UpdateAdminPasswordHash(id, hash) in queries_users.go
- Auth: add ChangePassword(username, old, new) method that verifies
  old password, validates length >= 8, and stores bcrypt hash
- Handlers: add handleChangePassword on PUT /api/auth/password (auth required)
- Router: register route inside protected group

Frontend:
- api.ts: add changePassword(oldPassword, newPassword)
- Settings.tsx: new page with form (current + new + confirm), client-side
  validation, success/error feedback
- App.tsx: add /settings route
- Layout.tsx: add 'Ajustes' nav item

web/src/api.ts

@@ -87,6 +87,8 @@ export const api = {
   login: (username: string, password: string) =>
     request<{ username: string }>("POST", "/auth/login", { username, password }),
   logout: () => request<{ ok: boolean }>("POST", "/auth/logout"),
+  changePassword: (oldPassword: string, newPassword: string) =>
+    request<{ ok: boolean }>("PUT", "/auth/password", { old_password: oldPassword, new_password: newPassword }),
 
   // dirty / apply
   dirty: () => request<{ modules: DirtyModule[] | null }>("GET", "/dirty"),