RED phase for Task 2: - Test 1: POST /api/me/password correct current → 200, new hash verifies newPassword - Test 2: wrong currentPassword → 401, UPDATE not called (hash unchanged) - Test 3: no local_credentials row → 404 - Test 4 (GET /api/me): hasLocalCredential:true/false based on local_credentials existence