Enforce session-only identity for password-change (remove bearer-token fallback)

[markwylde]

Motivation

• Prevent a 2FA bypass where password-change endpoints could accept a bearer JWT fallback when session validation failed, allowing password-only authentication to circumvent OTP enforcement.

Description

• Removed the bearer-token fallback and JWT verification from requirePasswordChangeIdentity so identity for password-change flows is derived only from requireSession and therefore subject to existing OTP/session checks.
• Cleaned up unused imports in packages/api/src/controllers/user/passwordAuth.ts as part of the change.

Testing

• Ran npm run tidy, which completed (reported lint/info warnings but no failures).
• Ran npm run build, which completed successfully though brochureware PDF generation emitted platform warnings about missing system libraries; overall build succeeded.

---

Codex Task