fix(account)!: separate password permission and update coordinated dependencies

[Vonng]

The Change Password button currently follows CreateUser, coupling self-service password changes to privileged user administration. Use admin:ChangeMyPassword and the matching silo-pkg session evaluation, with regressions for legacy CreateUser denies, explicit password denies, user-admin grants, and external identity providers.

Breaking authorization compatibility: with the matching Server, a saved CreateUser deny no longer locks the caller's password, while an existing ChangeMyPassword deny is now enforced. Add ChangeMyPassword to the same legacy Deny statement before upgrading when the old restriction must hold. The updated built-in readonly also no longer overrides a separate CreateUser grant; saved overrides retain their existing statements. The capability list returned to Console changes, and mixed Server/Console versions can disagree about the button and enforced action. This is a permission-design change independent of the SDK update; policies are not migrated automatically.

The changelog explicitly marks this breaking change and links the migration guide, including the before/after matrix, read-only policies, coordinated rollout and rollback limits. Keep both denies during a rollback window if the old combined restriction must hold; an old Server cannot enforce a password-only deny for this endpoint.

Select the merged dependencies from silo-pkg #6 and mcli #41: minio-go 78bfa91607c2, silo-pkg 2d8fd3cbbf07, and mcli e6a60edf0952. Regenerate embedded frontend assets, README replacement instructions and CREDITS. Embedder checks compare against the selected package version instead of an obsolete hard-coded version; README and the dependency release record agree with the final merged source pins.

The first CI audit also exposed the existing knip dependency on smol-toml 1.6.1 (CVE-2026-85730). Update only that lockfile resolution to the patched 1.7.1, verify normal and malformed TOML inputs, and rerun the high-severity audit. The embedded runtime assets are unchanged by this development dependency patch.

Validation:

• GOWORK=off go test ./api/... ./pkg/...
• Formatter and Go lint: zero issues; replacement, dependency-record and credits checks pass
• GOWORK=off bash hack/embedder-compat.sh
• Frontend build and typecheck; 225 frontend unit tests
• Five Chromium checks (including authentication setup)
• Live embedded SILO: ordinary and legacy-policy users change passwords, refresh their sessions, reject old passwords and log in with new passwords; a password-denied user has a disabled button and a refused API request
• Changelog follow-up checked against the pre-split and current implementations; git diff --check passes, with no runtime or dependency changes

The matching Server #175 is required. The existing release gate remains intact: silo-pkg v3.13.4 is recorded as pending, and mcli source must pass the existing main-branch checks before a Console tag can be released. This PR does not create tags or release artifacts. Upstream minio-go #2274 remains open and is absent from the SDK pin.