fix: keep password form visible on validation error

The password setup/change form used hx-target="#password-section" with
hx-swap="innerHTML", but that div wraps the form itself. On a validation
error the route returns only an alert div, so the swap replaced the entire
form — the password inputs disappeared. Most visible during registration's
"set password" step.

Retarget the form to a dedicated #password-error div outside the form
(mirrors the working login form's #login-error pattern), so the form and
its inputs survive errors while messages still render inside #password-section.

Also fix pre-existing broken e2e tests: they omitted the required
current_password fill and used passwords below the zxcvbn strength
threshold (score 1 < MIN_PASSWORD_STRENGTH=2).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/porchlight/templates/manage/credentials.html

@@ -38,7 +38,8 @@
         {% else %}
         <p>No password set.</p>
         {% endif %}
-        <form hx-post="/manage/credentials/password" hx-target="#password-section" hx-swap="innerHTML">
+        <div id="password-error"></div>
+        <form hx-post="/manage/credentials/password" hx-target="#password-error" hx-swap="innerHTML">
             <input type="hidden" name="csrf_token" value="{{ csrf_token_processor(request) }}">
             {% if has_password %}
             <div>