Change Password

Change user's master password by re-keying all workspace keys.

Client must:

1. Sign "email|timestamp" with current Ed25519 key (proves current password)
2. Provide new Ed25519 signing key (derived from new password)
3. Re-wrap all workspace keys with new X25519 public key

Server will:

1. Verify signature with stored signing_key_pub
2. Derive new X25519 encryption key from new Ed25519 signing key
3. Update both keys and all workspace wrapped keys

Note: This changes the master password (encryption password), not authentication password. Both local and SSO users can change their master password.