feat: ctrl+click for new tabs, delete redirect, password change

- Protocol and collection pills now use <a href> instead of <div onclick>,
  so ctrl+click (or cmd+click) opens in a new tab, and middle-click works
- Applied consistently: library, collection detail, user profile
- After deleting a protocol or collection, currentRoute is reset so
  navigation back to the list actually works
- Password change: when viewing your own profile, a 'Change Password'
  button appears. Opens a modal requiring current password + new password
  + confirmation. New API endpoint POST /api/auth/password validates
  the current password and updates the hash.

api/index.php

@@ -167,6 +167,7 @@ if ($parts[0] === 'auth') {
     elseif ($action === 'logout' && $method === 'POST') handle_logout();
     elseif ($action === 'me' && $method === 'GET') handle_me();
     elseif ($action === 'sso' && $method === 'POST') handle_sso_callback();
+    elseif ($action === 'password' && $method === 'POST') handle_password_change();
     else respond(404, ['error' => 'Unknown auth endpoint']);
 }