Feature: change password and delete account

## Summary
Users can edit their username, name and avatar (`/api/users//edit`) but cannot change their password or delete their account. Deleting is also not safe to bolt on: `User.reviews` and `User.restaurants` have no cascade (`app/models/user.py:23-24`), so a raw `db.session.delete(user)` would violate foreign keys, and any S3 avatar or photos would be orphaned.

## Proposal
- `PUT /api/users//password` requiring the current password, with the minimum-length rule shared with signup (see the hardening issue).
- `DELETE /api/users/` (own account only, password confirmation). Decide between a hard delete with cascades (reviews, responses, owned restaurants with their images and reviews, S3 objects) and a soft delete that anonymises reviews as "Deleted user" while hard-deleting owned restaurants after a confirmation that lists what will go. The second option preserves review history for other businesses.
- An "Account" section in the Edit profile modal or a new `/settings` route.
- Tests for the cascade behaviour.

Start with app/models/user.py:23-24 and the existing /api/users//edit endpoint; then trace signup's minimum-password rule and the avatar/photo S3 ownership paths. Resolve the hard-delete versus soft-delete choice, define the confirmation and ownership behavior, and add cascade-behavior tests covering the selected outcome.

Written by the indexing model from the issue text.