fix(19): CR-03 return 403 for wrong current password so change-password does not log user out

apps/pwa/src/api/client.ts

@@ -141,9 +141,14 @@ export async function fetchLocalLogout(): Promise<void> {
  * Requires the user's current password and a new password (min 8 chars).
  *
  * Status codes:
- *   401 → wrong current password (throws Error with code 'wrong-current')
- *   422 → validation failure (throws Error with code 'validation')
- *   other non-ok → generic error
+ *   403 → wrong current password (throws Error('wrong-current')) — NOT a session expiry
+ *   401 / opaqueredirect → genuine session expiry (throws SessionExpiredError)
+ *   other non-ok → generic error (throws Error('server'))
+ *
+ * CR-03: the server returns 403 (not 401) for an incorrect current password so this
+ * client can distinguish an in-app authorization failure from a real session expiry.
+ * Treating that case as 401 would route it to the global MutationCache session-expiry
+ * handler and forcibly log the user out for a simple mistyped password.
  */
 export async function fetchChangePassword(body: {
   currentPassword: string;
@@ -157,6 +162,8 @@ export async function fetchChangePassword(body: {
     body: JSON.stringify(body),
   });
 
+  // 403 → wrong current password (in-app). Check BEFORE the 401 session-expiry branch.
+  if (res.status === 403) throw new Error('wrong-current');
   if (res.type === 'opaqueredirect' || res.status === 401) throw new SessionExpiredError();
   if (!res.ok) {
     const detail = (await res.json().catch(() => ({}))) as { code?: string };