fix(web): redirect from server action after password change

client-side router.push races with Set-Cookie processing. redirect() in the
server action sends cookie + redirect in one response — browser applies the
new JWT before navigating, so middleware sees mustChangePassword=false.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/web/src/app/(portal)/change-password/page.tsx

@@ -43,17 +43,9 @@ export default function ChangePasswordPage() {
     startTransition(async () => {
       const result = await changePasswordAction(currentPassword, newPassword);
 
-      if (!result.success) {
+      if (result) {
         setError(result.error);
-        return;
       }
-
-      if (user) {
-        setUser({ ...user });
-      }
-
-      router.push('/');
-      router.refresh();
     });
   }