fix: return m.change_password capability based on login_with_password config

[chbgdn]

Sets the m.change_password capability based on the login_with_password config option. By default, the capability returns enabled: true, but now it will correctly return enabled: false when password login is disabled (e.g., SSO-only setups).

This allows clients to correctly determine whether password changes are supported.

[jevolk]

Thank you for this but I don't think we can merge it until #314 is closed as SSO users must be able to set a password right now to use UIA-requiring features such as session removal.

[chbgdn]

@jevolk I actually have a working branch that implements SSO UIA, which would allow SSO users to use UIA-requiring features. The code isn't perfect, but it's tested and working.

Would you like me to open it as a draft PR so you can see the approach?

[jevolk]

@jevolk I actually have a working branch that implements SSO UIA, which would allow SSO users to use UIA-requiring features. The code isn't perfect, but it's tested and working.

Would you like me to open it as a draft PR so you can see the approach?

Wow ABSOLUTELY! 🙏 I will be happy to pick up where you left off. This is a high priority issue going into the next dev cycle.

[chbgdn]

Wow ABSOLUTELY! 🙏 I will be happy to pick up where you left off. This is a high priority issue going into the next dev cycle.

I've opened this as a draft PR (#389).

Just to set expectations - this is more of a prototype/proof of concept. I'm not sure I have the skills/experience to polish it to merge-ready state, but hopefully the implementation can be useful as a reference or starting point.

Feel free to take ideas/code from it if helpful, or I can try to improve it with your guidance.