feat: complete remaining Go backend modules

tests/auth-password-change-contract.test.ts

@@ -0,0 +1,17 @@
+import { readFile } from "node:fs/promises";
+import { describe, expect, it } from "vitest";
+
+describe("Go password change v1 contract", () => {
+  it("pins the transactional password and replacement-cookie implementation", async () => {
+    const fixture = JSON.parse(await readFile(new URL("../contracts/auth/password-change-v1.json", import.meta.url), "utf8"));
+    const http = await readFile(new URL("../backend/internal/httpapi/auth_password_change.go", import.meta.url), "utf8");
+    const identity = await readFile(new URL("../backend/internal/identity/password_change.go", import.meta.url), "utf8");
+    const postgres = await readFile(new URL("../backend/internal/postgres/password_change.go", import.meta.url), "utf8");
+    expect(fixture).toMatchObject({ version: 1, path: "/api/auth/password/change", minimumPasswordLength: 8, incrementsSessionVersion: true });
+    expect(http).toContain("identity.SetSessionCookies");
+    expect(http).toContain("PlatformApp");
+    expect(identity).toContain("len(command.NewPassword) < 8");
+    expect(postgres).toContain("FOR UPDATE");
+    expect(postgres).toContain("session_version = session_version + 1");
+  });
+});