ui: /settings/account self-service password change

Adds GET/POST handlers for /settings/account in the viewer band
(any authenticated user), account.html template with current-password
field suppressed when must_change_password is set, and audits the
change via AppendAudit.

internal/server/http/server.go

@@ -182,6 +182,8 @@ func (s *Server) routes(r chi.Router) {
 			r.Get("/alerts", s.handleUIAlerts)
 			r.Get("/audit", s.handleUIAudit)
 			r.Get("/audit.csv", s.handleUIAuditCSV)
+			r.Get("/settings/account", s.handleUIAccountGet)
+			r.Post("/settings/account", s.handleUIAccountPost)
 		}
 	})