SSO users have no passwordHash and should be able to set a local password
without providing a current one. Users with an existing password still
must verify it. Removes the client-side required attribute and updates
the server-side logic accordingly.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>