feat: ctrl+click for new tabs, delete redirect, password change

- Protocol and collection pills now use <a href> instead of <div onclick>,
  so ctrl+click (or cmd+click) opens in a new tab, and middle-click works
- Applied consistently: library, collection detail, user profile
- After deleting a protocol or collection, currentRoute is reset so
  navigation back to the list actually works
- Password change: when viewing your own profile, a 'Change Password'
  button appears. Opens a modal requiring current password + new password
  + confirmation. New API endpoint POST /api/auth/password validates
  the current password and updates the hash.

frontend/index.html

@@ -43,7 +43,7 @@
     </div>
     <div class="sort-bar" id="sortBar">
       <span class="sort-label">sort:</span>
-      <span class="sort-option active" onclick="setSort('date')">most recent</span>
+      <span class="sort-option active" onclick="setSort('date')">date added</span>
       <span class="sort-option" onclick="setSort('relevance')">relevance</span>
       <span class="filter-toggle" onclick="toggleFilterPanel()">&#9776; filter</span>
     </div>
@@ -69,7 +69,7 @@
     </div>
     <div class="detail-section">
       <h2>What is a protocol?</h2>
-      <p class="outcome">A protocol is a pattern of interaction among agents, represented here in the form of a particular sequence of actions. Protocols are micro-practices — more specific than patterns and more interaction-focused than rules. A rule says "decisions are made by consensus." A protocol says "here's the step-by-step process for reaching consensus in a meeting."</p>
+      <p class="outcome">A protocol is a pattern of interaction among people, generally in the form of a particular sequence of actions. Protocols are micro-practices — more specific than patterns and more interaction-focused than rules. A rule says "decisions are made by consensus." A protocol says "here's the step-by-step process for reaching consensus in a meeting."</p>
     </div>
     <div class="detail-section">
       <h2>Features</h2>
@@ -77,7 +77,7 @@
     </div>
     <div class="detail-section">
       <h2>Self-hosting</h2>
-      <p class="outcome">Protocol Droid is designed to be self-hostable and whitelabel-able. It runs on a standard LAMP stack with no external dependencies — no web fonts, no CDNs, no tracking. Deploy on any LAMP server. Configure your site name, tagline, and theme through a simple config file.</p>
+      <p class="outcome">Protocol Droid is designed to be self-hostable and whitelabel-able. It runs on a standard LAMP stack with no external dependencies — no web fonts, no CDNs, no tracking. Deploy on Cloudron, any LAMP server, or your own infrastructure. Configure your site name, tagline, and theme through a simple config file.</p>
     </div>
     <div class="detail-section">
       <h2>Sister project</h2>
@@ -230,6 +230,31 @@
   <!-- TOAST -->
   <div class="toast" id="toast" style="display:none"></div>
 
+  <!-- PASSWORD CHANGE MODAL -->
+  <div class="modal-overlay" id="pwModal" style="display:none">
+    <div class="modal">
+      <h2>Change Password</h2>
+      <form id="pwForm" onsubmit="handleChangePassword(event)">
+        <div class="form-group">
+          <label>Current Password</label>
+          <input type="password" id="pwCurrent" required placeholder="••••••••">
+        </div>
+        <div class="form-group">
+          <label>New Password</label>
+          <input type="password" id="pwNew" required minlength="8" placeholder="••••••••">
+        </div>
+        <div class="form-group">
+          <label>Confirm New Password</label>
+          <input type="password" id="pwConfirm" required minlength="8" placeholder="••••••••">
+        </div>
+        <div class="actions">
+          <button type="submit" class="btn primary">Change Password</button>
+          <button type="button" class="btn" onclick="closePwModal()">Cancel</button>
+        </div>
+      </form>
+    </div>
+  </div>
+
 </main>
 
 <script src="/frontend/app.js"></script>