Add change password functionality with validation and email notification

Documentation/Auth-API.md

@@ -233,6 +233,92 @@ The new password must contain at least one uppercase letter, one lowercase lette
 
 ---
 
+## Change Password
+
+Changes the authenticated user's password. After a successful change, all refresh sessions are revoked, authentication cookies are cleared, and the user must log in again.
+
+**Endpoint:** `POST` [http://localhost:3070/api/auth/change-password](http://localhost:3070/api/auth/change-password)
+
+**Authentication:** Required
+
+The access token may be supplied through the `access_token` cookie or as a Bearer token:
+
+```http
+Authorization: Bearer <access-token>
+```
+
+### Request body
+
+```json
+{
+  "currentPassword": "CurrentPassword@1234",
+  "newPassword": "NewPassword@5678",
+  "confirmPassword": "NewPassword@5678"
+}
+```
+
+The new password:
+
+- Must match `confirmPassword`
+- Must differ from the current password
+- Must contain at least one uppercase letter
+- Must contain at least one lowercase letter
+- Must contain at least one symbol
+- Must contain at least four digits
+
+### Success response — `200 OK`
+
+```json
+{
+  "success": true,
+  "message": "Password changed successfully. Please login again."
+}
+```
+
+### Error responses
+
+#### `400 Bad Request`
+
+Returned when required fields are missing, the passwords do not match, the new password does not satisfy the password policy, or it matches the current password.
+
+```json
+{
+  "success": false,
+  "message": "New password and confirm password do not match"
+}
+```
+
+#### `401 Unauthorized`
+
+Returned when authentication fails or the current password is incorrect.
+
+```json
+{
+  "success": false,
+  "message": "Current password is incorrect"
+}
+```
+
+#### `404 Not Found`
+
+```json
+{
+  "success": false,
+  "message": "User not found"
+}
+```
+
+#### `500 Internal Server Error`
+
+```json
+{
+  "success": false,
+  "message": "Failed to change password"
+}
+```
+
+---
+
 ## Logout
 
 Deletes the current refresh session when available and clears both authentication cookies.