fix(web): redirect from server action after password change

client-side router.push races with Set-Cookie processing. redirect() in the
server action sends cookie + redirect in one response — browser applies the
new JWT before navigating, so middleware sees mustChangePassword=false.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/web/src/lib/auth-actions.ts

@@ -96,7 +96,6 @@ export async function logout(): Promise<void> {
 }
 
 export type ChangePasswordResult =
-  | { success: true }
   | { success: false; error: 'wrongCurrentPassword' | 'networkError' };
 
 export async function changePasswordAction(
@@ -136,7 +135,6 @@ export async function changePasswordAction(
 
     // Forward new session cookie from API (mustChangePassword=false baked in)
     const setCookieHeader = response.headers.get('set-cookie');
-    console.log('[changePasswordAction] set-cookie header:', setCookieHeader);
     if (setCookieHeader) {
       const sessionMatch = setCookieHeader.match(/session=([^;]+)/);
       if (sessionMatch) {
@@ -151,7 +149,7 @@ export async function changePasswordAction(
       }
     }
 
-    return { success: true };
+    redirect('/');
   } catch (err) {
     console.error('[changePasswordAction] fetch threw:', err);
     return { success: false, error: 'networkError' };