* [AI] Fix OIDC privilege escalation in /change-password endpoint
Add admin role check and password auth_method session check to prevent
non-admin or OIDC-authenticated users from changing the server password.
Previously, any authenticated user could overwrite the password hash and
then login via password method to obtain an ADMIN session.
https://claude.ai/code/session_01Wne9FY2QnKp6JF7g61B1Sn
* Add release notes for PR #7207
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
