fix(auth): let OAuth-only users enable 2FA without a password confirmation

Users with a linked OAuth identity or no password cannot confirm a
password they do not know. The password.confirm middleware now follows
User::requiresPasswordConfirmation(), like destructive actions.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Http/Kernel.php

@@ -17,6 +17,7 @@ use App\Http\Middleware\EnsureTeamMcpEnabled;
 use App\Http\Middleware\EnsureTokenBelongsToCurrentTeamMember;
 use App\Http\Middleware\PreventRequestsDuringMaintenance;
 use App\Http\Middleware\RedirectIfAuthenticated;
+use App\Http\Middleware\RequirePassword;
 use App\Http\Middleware\TrimStrings;
 use App\Http\Middleware\TrustProxies;
 use App\Http\Middleware\ValidateSignature;
@@ -24,7 +25,6 @@ use App\Http\Middleware\VerifyCsrfToken;
 use Illuminate\Auth\Middleware\AuthenticateWithBasicAuth;
 use Illuminate\Auth\Middleware\Authorize;
 use Illuminate\Auth\Middleware\EnsureEmailIsVerified;
-use Illuminate\Auth\Middleware\RequirePassword;
 use Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse;
 use Illuminate\Foundation\Http\Kernel as HttpKernel;
 use Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull;

app/Http/Middleware/RequirePassword.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Auth\Middleware\RequirePassword as Middleware;
+
+class RequirePassword extends Middleware
+{
+    /**
+     * Users with a linked OAuth identity, or without a password, cannot confirm
+     * a password they do not know. They follow the same rule as destructive
+     * actions (see User::requiresPasswordConfirmation()).
+     */
+    protected function shouldConfirmPassword($request, $passwordTimeoutSeconds = null)
+    {
+        if ($request->user()?->requiresPasswordConfirmation() === false) {
+            return false;
+        }
+
+        return parent::shouldConfirmPassword($request, $passwordTimeoutSeconds);
+    }
+}