refactor(settings): consolidate user profile into single settings page

Drop the standalone /settings/profile route + user-profile component;
folding the same fields into user-settings means one place to update
and one menu item. UserMenu loses the Profile dropdown entry.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/components/settings/user-settings.tsx

@@ -435,6 +435,8 @@ export function UserSettings() {
           </CardContent>
         </Card>
 
+        <ChangePasswordCard />
+
         <section id="notifications" className="space-y-4">
           <div>
             <h2 className="text-lg font-semibold">Notifications</h2>
@@ -459,3 +461,134 @@ export function UserSettings() {
     </div>
   );
 }
+
+/** Direct change-password form (current + new). Lifted from the deprecated
+ *  user-profile.tsx into the unified settings page so we keep both reset-via-
+ *  email and change-in-place flows on a single screen. */
+function ChangePasswordCard() {
+  const [currentPassword, setCurrentPassword] = useState('');
+  const [newPassword, setNewPassword] = useState('');
+  const [confirmPassword, setConfirmPassword] = useState('');
+  const [revokeOthers, setRevokeOthers] = useState(true);
+  const [savingPassword, setSavingPassword] = useState(false);
+  const [passwordMessage, setPasswordMessage] = useState<{
+    kind: 'ok' | 'err';
+    text: string;
+  } | null>(null);
+
+  async function changePassword(e: React.FormEvent) {
+    e.preventDefault();
+    setPasswordMessage(null);
+    if (newPassword.length < 9) {
+      setPasswordMessage({ kind: 'err', text: 'New password must be at least 9 characters' });
+      return;
+    }
+    if (newPassword !== confirmPassword) {
+      setPasswordMessage({ kind: 'err', text: 'New password and confirmation do not match' });
+      return;
+    }
+    setSavingPassword(true);
+    try {
+      await apiFetch('/api/v1/me/password', {
+        method: 'POST',
+        body: { currentPassword, newPassword, revokeOtherSessions: revokeOthers },
+      });
+      setCurrentPassword('');
+      setNewPassword('');
+      setConfirmPassword('');
+      setPasswordMessage({
+        kind: 'ok',
+        text: revokeOthers
+          ? 'Password changed. Other sessions have been signed out.'
+          : 'Password changed.',
+      });
+    } catch (err) {
+      setPasswordMessage({
+        kind: 'err',
+        text: err instanceof Error ? err.message : 'Failed to change password',
+      });
+    } finally {
+      setSavingPassword(false);
+    }
+  }
+
+  return (
+    <Card>
+      <CardHeader>
+        <CardTitle>Change password</CardTitle>
+        <CardDescription>
+          Minimum 9 characters. You&rsquo;ll be prompted to sign in again on your other devices if
+          you check the box below.
+        </CardDescription>
+      </CardHeader>
+      <CardContent>
+        <form onSubmit={changePassword} className="space-y-4 max-w-md">
+          <div>
+            <Label htmlFor="currentPassword">Current password</Label>
+            <Input
+              id="currentPassword"
+              type="password"
+              autoComplete="current-password"
+              required
+              value={currentPassword}
+              onChange={(e) => setCurrentPassword(e.target.value)}
+              className="mt-1"
+            />
+          </div>
+          <div>
+            <Label htmlFor="newPassword">New password</Label>
+            <Input
+              id="newPassword"
+              type="password"
+              autoComplete="new-password"
+              required
+              minLength={9}
+              value={newPassword}
+              onChange={(e) => setNewPassword(e.target.value)}
+              className="mt-1"
+            />
+          </div>
+          <div>
+            <Label htmlFor="confirmPassword">Confirm new password</Label>
+            <Input
+              id="confirmPassword"
+              type="password"
+              autoComplete="new-password"
+              required
+              minLength={9}
+              value={confirmPassword}
+              onChange={(e) => setConfirmPassword(e.target.value)}
+              className="mt-1"
+            />
+          </div>
+          <div className="flex items-center gap-2">
+            <input
+              id="revokeOthers"
+              type="checkbox"
+              checked={revokeOthers}
+              onChange={(e) => setRevokeOthers(e.target.checked)}
+              className="h-4 w-4"
+            />
+            <Label htmlFor="revokeOthers" className="text-sm font-normal cursor-pointer">
+              Sign out of other devices
+            </Label>
+          </div>
+          <div className="flex items-center gap-3">
+            <Button type="submit" disabled={savingPassword} size="sm">
+              Change password
+            </Button>
+            {passwordMessage ? (
+              <span
+                className={
+                  passwordMessage.kind === 'ok' ? 'text-sm text-green-600' : 'text-sm text-red-600'
+                }
+              >
+                {passwordMessage.text}
+              </span>
+            ) : null}
+          </div>
+        </form>
+      </CardContent>
+    </Card>
+  );
+}