Fix authenticated profile self-service

[TehWardy]

Summary

• restore authenticated POST /Api/Account/ChangePassword after the aggregate split
• add authenticated PUT /Api/Account/Me for editable self-profile fields
• keep identity, password hash, lockout and confirmation state server-owned
• preserve and prove the separate public ForgotPassword -> token-backed ConfirmForgotPassword recovery flow
• return safe status codes for anonymous, invalid-credential, validation, dependency, and unexpected failures

Verification

• analyzer-enabled cCoder.Security.Tests: 115 passed before focused failure-boundary additions
• focused controller tests: 14 passed
• baseline Assets contract tests cover authenticated change-password and token-backed reset endpoints