idp: add PUT /idp/credentials for self-service password change - #355

* account-pane: phase 1 — change-password form (#12)

New pane that drives JSS's PUT /idp/credentials endpoint (shipped in
JavaScriptSolidServer/JavaScriptSolidServer#355, JSS 0.0.165).

- canHandle: only on the authenticated user's own WebID profile
  (subject doc URI matches window.xlogin.id's doc URI)
- IDP endpoint resolved from solid:oidcIssuer in the profile JSON-LD
  (the very resource we render on always carries it)
- Form: current / new / confirm-new with client-side validation
  (non-empty, new !== current, new === confirm)
- Submit via window.xlogin.authFetch (Bearer/DPoP added by xlogin)
- Status mapping: 200 → ok toast, 401 → wrong-password inline error,
  400/403/other → contextual error
- Anonymous users never see this pane (canHandle returns false when
  no auth)

Phase 2+ (delete account, export, portability) waits on JSS endpoints
in #352/#353/#354.

* account-pane: preflight before sending password (#12)

Critical: prior commit could leak the password to disk on JSS <0.0.165
because the wildcard LDP PUT handler caught the request and wrote the
JSON body as a file at /idp/credentials. Verified happened on
solid.social during testing — see PR #13 thread.

Now the pane sends an UNAUTHENTICATED probe PUT first. The dedicated
handler in JSS 0.0.165+ returns a specific 401 with body
{error: "invalid_token", error_description: "Authentication required"}.
Wildcard fallthrough on older JSS produces a different error shape (or
no JSON body), so we only proceed with the real PUT after seeing the
sentinel.

The probe is unauthenticated and has no body, so even if it falls
through to the wildcard on a misconfigured server, no credentials are
leaked — at worst an empty file is created.

Also: bcrypt rotation fix (e.g. solid:oidcIssuer key shape) from prior
commit retained.

* account-pane: address Copilot security + a11y feedback (PR #13)

Security (CRITICAL):
- validateIssuer: refuse to send credentials when solid:oidcIssuer's
  hostname doesn't match the current page's hostname (or a parent
  domain — e.g. melvin.solid.social on solid.social IDP). Tampered
  profile cannot redirect the password to an attacker origin.
  Same-protocol enforcement prevents downgrade attacks.

Bug fixes:
- readOidcIssuer: try a wider set of common subject fragments
  (#me/#this/#i/#card and the doc URI itself) so profiles with
  non-#me fragments resolve correctly
- clearInputs via refs: html.js patches attributes via setAttribute()
  which doesn't sync input.value. Use ref()/ref.el.value = '' to
  imperatively clear after success

Accessibility:
- label for=/input id= association on all three password fields
  (click-to-focus + screen reader labelling)
- role="status" aria-live="polite" wrapper around success/error
  messages so assistive tech announces the state change

Declined:
- Preflight removal (Copilot: brittle gate). Leak risk strictly worse
  than false-negative gate; preflight stays.
- Doubled-PUT cost. Same tradeoff.

* account-pane: also compare port in validateIssuer (PR #13 round 3)

Tampered profile could swap port (e.g. solid.social:8443) and pass
the hostname check while pointing at an attacker's listener. URL.port
comparison closes that.

External-IDP setups (WebID points to shared IDP on unrelated host)
remain rejected — known limitation; proper fix waits on
melvincarvalho/xlogin#15 to expose the authenticated issuer.

* account-pane: render tampered issuer via html template, not raw innerHTML

Tampered solid:oidcIssuer like <img onerror=...> would execute when
interpolated into innerHTML. Switch the validateIssuer-fail branch to
losos/html.js's template tag, which treats ${} as text nodes.

* account-pane: tighten canHandle + document residual probe risk (PR #13 round 4)

canHandle: exact-match on subject.value vs window.xlogin.id. Same-doc
match was too loose — profile docs with both #me and #this would show
the Account tab on whichever node was rendered, breaking the contract.

Preflight comment: documents the residual risk (misconfigured JSS
<0.0.165 with world-writable ACL on /idp/credentials could see an
empty file created during probe). WAC normally rejects unauth PUT
before the wildcard runs, so this is theoretical. Proper zero-mutation
fix tracked at #14 (GET-based discovery via JSS's
handleCredentialsInfo, ships in JSS 0.0.166).

* account-pane: normalize default ports + handle JSON-LD array issuer (PR #13 round 5)

Caught by Copilot:

- URL.port is "" for default ports and "443"/"80" when explicit. The
  raw string comparison rejected same-origin pairs that just serialize
  the port differently. Normalize empty -> default-for-protocol before
  comparing.

- pickIssuer didn't unwrap JSON-LD array values. solid:oidcIssuer can
  be [{"@id": "..."}] in conformant JSON-LD; previous code returned
  the array and typeof check fell through to "no issuer found".

* account-pane: relax canHandle, target WebID directly in render (PR #13 round 6)

Previous exact-match canHandle hid the Account tab on profiles where
LOSOS's findSubject() prefers #this over #me (multi-node docs). The
underlying concern (wrong-subject issuer lookup) is better solved by
making render() target window.xlogin.id directly, regardless of which
subject the shell picked.

- canHandle: same-doc check (the pane is "this is my profile doc")
- render: readOidcIssuer(store, window.xlogin.id) — always the WebID

* account-pane: re-check auth at render-time for logout-after-boot (PR #13 round 7)

Tab list is built once during boot when canHandle ran. If the user
logs out between boot and clicking the tab, render() crashes on
window.xlogin.id deref. Guard at the top of render shows a friendly
'Log in to manage your account' empty-state instead.