docs: change password

[stsepelin]

Documents POST /auth/password from stsepelin/lukk#27, and moves the roadmap item from Planned to Shipped.

Leads with why the endpoint asks for the current password, since that's the entire security story and isn't self-evident — a stolen token already grants the account until it expires; if it could change the password it would grant the account permanently.

Explains the shared throttle and the session sweep rather than just stating them, and is honest that lukk-nuxt has no composable yet, showing the useLukkFetch call to use meanwhile.

Cross-linked from password-reset, the configuration feature table, and the events table.

pnpm docs:build passes with ignoreDeadLinks: false.

Greptile Summary

Documents the authenticated change-password endpoint and moves the feature into the shipped roadmap.

• Adds endpoint, security rationale, throttling, session-revocation, event, configuration, and temporary Nuxt usage guidance.
• Adds navigation and cross-links from password reset, configuration, events, and the roadmap.
• The temporary Nuxt example currently targets the app-API transport and overstates automatic form-error handling.

Confidence Score: 3/5

The documentation should not merge until the Nuxt example uses the correct authentication transport and accurately explains validation-error handling.

The server documentation is broadly consistent, but copying the client example directs the request through the application API base rather than the lukk auth endpoint, and its direct fetch call cannot provide the promised automatic field-error mapping.

Files Needing Attention: docs/change-password.md, docs/configuration.md, docs/events.md

Important Files Changed

Filename	Overview
docs/change-password.md	Adds the primary endpoint guide, but the Nuxt fallback uses the wrong transport base and promises error mapping absent from the shown code.
docs/configuration.md	Adds the feature-table entry while leaving the adjacent canonical feature snippet incomplete.
docs/events.md	Adds the correct event class under the wrong event category.
docs/password-reset.md	Adds a clear cross-link distinguishing authenticated password changes from forgotten-password resets.
docs/roadmap.md	Moves change password from planned work to the shipped feature list.
docs/.vitepress/config.mts	Adds the new change-password page to feature navigation.

Prompt To Fix All With AI

### Issue 1
docs/change-password.md:93
**Wrong transport for auth endpoint**

When a Nuxt user copies this example, `useLukkFetch` resolves `/password` against the application API base rather than the lukk authentication base, causing the request to miss the documented `POST /auth/password` endpoint or invoke an unrelated application route.

### Issue 2
docs/change-password.md:103
**Automatic form mapping is absent**

The shown code calls `useLukkFetch` directly and never submits a `useLukkForm`, so a 422 rejects with a `LukkError` instead of mapping validation errors onto fields “for free.” Users copying this example will not receive the documented form-error behavior.

### Issue 3
docs/configuration.md:194
**Feature snippet omits new toggle**

The table adds `change_password`, but the adjacent feature-toggle snippet still lists only the pre-existing keys. This leaves the copyable configuration reference incomplete and obscures how to disable an endpoint that is enabled by default.

### Issue 4
docs/events.md:98
**Package event is misclassified**

`Lukk\Events\PasswordChanged` is placed in the table described as containing standard Laravel authentication events, while the page otherwise separates `Lukk\Events\*` package events from `Illuminate\Auth\Events\*` framework events. This makes the event taxonomy misleading even though the class name itself is correct.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "docs: change password" | Re-trigger Greptile}

Greptile also left 4 inline comments on this PR.