You change your password from the terminal's Sessions screen with `p`: current and new asked, never echoed, through the action Settings uses #8127

For: a person who lives in the terminal can rotate their password without a browser, under the same throttle and rules as Settings › Password.

Done looks like:

• [ ] On the Sessions screen (src/tui/screens/signins.ts), a person signed in at the terminal presses p; the current password and then the new one are asked in masked fields (shown as dots, never the text), and the change goes through changePassword in src/actions/users.ts, the function POST /settings/password and the API call, so user.updated is emitted and the sign-in throttle applies.
• [ ] A wrong current password, a weak or too-long new one, and a throttled attempt each read as one sentence in Settings' words; the password is unchanged.
• [ ] An agent's terminal session is not offered p, as it is not offered m.
• [ ] The typed passwords are held only for the call and not kept on the screen's state after it, and never written to a log.
• [ ] A test under test/ (beside tui-signins.test.ts) proves a change that then signs in with the new password, a refused wrong current password, and that the typed text never appears in a rendered frame.

Files: src/tui/screens/signins.ts, a new test/tui-signins-password.test.ts Risks: the masked input must not leak through the frame buffer or scrollback; reuse the sign-in screen's masked field rather than writing a second.