feat: password management for tenant portal

- POST /api/tenant/password — change own Logto password
- POST /api/tenant/team/{userId}/password — reset team member password
- Settings page: "Change Password" card with confirm field
- Team page: "Reset Password" button per member with inline form
- LogtoManagementClient.updateUserPassword() via Logto Management API

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/pages/tenant/SettingsPage.tsx

@@ -1,10 +1,15 @@
+import { useState } from 'react';
 import {
   Alert,
   Badge,
+  Button,
   Card,
+  FormField,
+  Input,
   Spinner,
+  useToast,
 } from '@cameleer/design-system';
-import { useTenantSettings } from '../../api/tenant-hooks';
+import { useTenantSettings, useChangeOwnPassword } from '../../api/tenant-hooks';
 import { tierColor } from '../../utils/tier';
 import styles from '../../styles/platform.module.css';
 
@@ -20,6 +25,31 @@ function statusColor(status: string): 'success' | 'error' | 'warning' | 'auto' {
 
 export function SettingsPage() {
   const { data, isLoading, isError } = useTenantSettings();
+  const changePassword = useChangeOwnPassword();
+  const { toast } = useToast();
+
+  const [newPassword, setNewPassword] = useState('');
+  const [confirmPassword, setConfirmPassword] = useState('');
+
+  async function handleChangePassword(e: React.FormEvent) {
+    e.preventDefault();
+    if (newPassword.length < 8) {
+      toast({ title: 'Password must be at least 8 characters', variant: 'error' });
+      return;
+    }
+    if (newPassword !== confirmPassword) {
+      toast({ title: 'Passwords do not match', variant: 'error' });
+      return;
+    }
+    try {
+      await changePassword.mutateAsync(newPassword);
+      toast({ title: 'Password changed successfully', variant: 'success' });
+      setNewPassword('');
+      setConfirmPassword('');
+    } catch (err) {
+      toast({ title: 'Failed to change password', description: String(err), variant: 'error' });
+    }
+  }
 
   if (isLoading) {
     return (
@@ -75,6 +105,41 @@ export function SettingsPage() {
           To change your tier or other billing-related settings, please contact support.
         </p>
       </Card>
+
+      <Card title="Change Password">
+        <p className={styles.description} style={{ marginTop: 0 }}>
+          Update your login password. Minimum 8 characters.
+        </p>
+        <form onSubmit={handleChangePassword} style={{ display: 'flex', flexDirection: 'column', gap: 16, marginTop: 12 }}>
+          <FormField label="New password" htmlFor="new-pw">
+            <Input
+              id="new-pw"
+              type="password"
+              value={newPassword}
+              onChange={(e) => setNewPassword(e.target.value)}
+              placeholder="Enter new password"
+              required
+              minLength={8}
+            />
+          </FormField>
+          <FormField label="Confirm password" htmlFor="confirm-pw">
+            <Input
+              id="confirm-pw"
+              type="password"
+              value={confirmPassword}
+              onChange={(e) => setConfirmPassword(e.target.value)}
+              placeholder="Confirm new password"
+              required
+              minLength={8}
+            />
+          </FormField>
+          <div>
+            <Button type="submit" variant="primary" loading={changePassword.isPending}>
+              Change Password
+            </Button>
+          </div>
+        </form>
+      </Card>
     </div>
   );
 }