fix: skip currentPassword check for federated users on change-password

packages/server/src/routes/users.ts

@@ -72,7 +72,11 @@ export async function userRoutes(app: FastifyInstance): Promise<void> {
       return reply.code(404).send({ error: 'User not found', statusCode: 404 });
     }
 
-    // All users must provide current password (federated users have a local password hash)
+    // Federated users (replicas on this instance) don't need currentPassword —
+    // their home instance already verified the password change, and JWT auth
+    // proves identity. The homeInstance field comes from the DB, not the request.
+    if (!user.homeInstance) {
+      // Local users must provide current password
       if (!currentPassword || typeof currentPassword !== 'string') {
         return reply.code(400).send({ error: 'Current password is required', statusCode: 400 });
       }
@@ -80,6 +84,7 @@ export async function userRoutes(app: FastifyInstance): Promise<void> {
       if (!valid) {
         return reply.code(403).send({ error: 'Incorrect password', statusCode: 403 });
       }
+    }
 
     const newHash = await hashPassword(newPassword);
     db.update(schema.users).set({ passwordHash: newHash, passwordChangedAt: Date.now() }).where(eq(schema.users.id, request.userId)).run();