Users with a linked OAuth identity or no password cannot confirm a
password they do not know. The password.confirm middleware now follows
User::requiresPasswordConfirmation(), like destructive actions.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>