fix(19): CR-03 return 403 for wrong current password so change-password does not log user out

apps/api/src/routes/me.ts

@@ -257,7 +257,12 @@ meRouter.post(
     // T-19-07: verify current password before any update
     const isCorrect = verifyPassword(credRow.passwordHash, currentPassword);
     if (!isCorrect) {
-      return c.json({ error: 'Current password incorrect' }, 401);
+      // CR-03: return 403 (NOT 401) for a wrong current password. The PWA's global
+      // MutationCache treats any 401 as "session expired" and arms the re-auth
+      // interstitial / login redirect — so a 401 here would force-log-out a user who
+      // merely mistyped their current password. 403 is in-app authorization-failure and
+      // lets the client surface "current password incorrect" without dropping the session.
+      return c.json({ error: 'Current password incorrect' }, 403);
     }
 
     try {

apps/api/tests/routes/me.test.ts

@@ -330,7 +330,7 @@ describe('POST /api/me/password — self-change password (AUTH-LOCAL-09)', () =>
     expect(verifyPassword(updatedHash!, oldPassword)).toBe(false);
   });
 
-  it('Test 2: wrong currentPassword → 401 and update is NOT called', async () => {
+  it('Test 2: wrong currentPassword → 403 and update is NOT called', async () => {
     const { db } = await import('../../src/db/client.js');
 
     const realPassword = 'real-password-correct-789';
@@ -374,7 +374,9 @@ describe('POST /api/me/password — self-change password (AUTH-LOCAL-09)', () =>
       body: JSON.stringify({ currentPassword: 'WRONG-password', newPassword: 'new-pass-12345678' }),
     });
 
-    expect(res.status).toBe(401);
+    // CR-03: wrong current password returns 403 (in-app authz failure), NOT 401.
+    // A 401 would be interpreted by the PWA as session expiry and log the user out.
+    expect(res.status).toBe(403);
     const body = (await res.json()) as { error: string };
     expect(body.error).toBe('Current password incorrect');
     // Update must NOT have been called