Double response and logic error in account settings update

p5.js version

No response

What is your operating system?

None

Web browser and version

No response

Actual Behavior

In updateSettings() multiple code paths send a response but do not return, so:

1. Social login user setting password: saveUser(res, user) is called (sends 200), then execution continues and can send 401.
2. Password update: await saveUser(res, user) sends response, then execution falls through and saveUser() is called again in the else block.

Result: "Cannot set headers after they are sent", inconsistent client state, or users seeing errors despite success.

Location: server/controllers/user.controller/authManagement.ts lines 159–201

Expected Behavior

Each code path that sends a response should return immediately. Only one response per request.

Steps to reproduce

1. Log in with a social account (e.g. Google) that has no password set.
2. Go to Account settings and set a new password (no current password).
3. Submit the form. Observe: success response may be sent, then 401 or double-response error.
4. Alternatively: log in with email/password, change password, submit. Observe possible double response or header errors.

Snippet:

// authManagement.ts - updateSettings (simplified)
if (user.password === undefined) {
  user.password = req.body.newPassword;
  saveUser(res, user);  // sends response, no return
}
if (!req.body.currentPassword) {
  res.status(401).json({ ... });  // second response
  return;
}
// ...
await saveUser(res, user);  // line 177 - sends response
// no return - falls through to:
} else {
  await saveUser(res, user);  // line 201 - sends again
}

Open server/controllers/user.controller/authManagement.ts and inspect updateSettings(), especially lines 159–201 and the saveUser() calls. Reproduce the social-login password-setting and password-update flows described in the issue. Done means each request sends exactly one response without a headers-already-sent error or an incorrect 401 after success.