Set or change password

Full sessions only. current_password is required only when the account already has one; a magic-link account may set its first password only within 10 minutes of signing in (else 403 reauth_required). Wrong current password returns 403, not 401. A change ends every other session: all refresh tokens except keep_refresh_token are revoked and access tokens already minted stop working (identity epoch), so the caller refreshes on the session it kept.

curl -X POST "https://example.com/v1/me/password" \  -H "Content-Type: application/json" \  -d '{    "new_password": "stringst"  }'

{  "message": "string"}