Replaces the password of the account named by the access token presented with this
request. It changes no other account: the request body carries no user, e-mail or
tenant identifier, so there is nothing in it to aim elsewhere.

The current password is required even though the session is already valid.
Reauthentication on a credential change is the settled industry pattern (OWASP ASVS
2.1.x; Keycloak, Auth0 and Okta all require it) and it is what stops a stolen access
token from taking the account over permanently.

Password policy — at least 12 characters, with at least one lower-case letter,
one upper-case letter, one digit and one special character; and different from the last
5 passwords of this account.

One refusal for three causes. A wrong current password, a new password that
violates the policy and a new password that repeats a recent one all answer with a
byte-identical 400, so a caller cannot tell which was true. A subject
whose credential is held by an external identity provider is refused differently, with
409 and its own problem type: telling such a caller their password is

wrong for an account that has none would be untrue and unactionable.

On success every live token of the account is refused from that moment on and the
caller is expected to sign in again. A refusal writes nothing.