fix(api): use user.id instead of user.sub in changePassword controller

JWT strategy maps payload.sub to user.id — user.sub was always undefined,
causing Prisma findUnique to fail with id: undefined validation error.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/api/src/auth/auth.controller.ts

@@ -99,7 +99,7 @@ export class AuthController {
     @Body() dto: ChangePasswordDto,
   ) {
     await this.authService.changePassword(
-      user.sub,
+      user.id,
       dto.currentPassword,
       dto.newPassword,
     );