fix(强制改密): 登录态用户仅放行改密并优化首次改密流程

- 强制改密用户修改密码时无需 current_password

- 保持其余接口返回423以阻止未改密操作

app/Http/Controllers/Api/AuthController.php

@@ -122,10 +122,15 @@ class AuthController extends Controller
         /** @var User $user */
         $user = Auth::guard('api')->user();
 
-        $validated = $request->validate([
-            'current_password' => ['required', 'current_password:api'],
+        $rules = [
             'password' => ['required', 'confirmed', Password::min(6)],
-        ]);
+        ];
+
+        if (! $user->force_password_change) {
+            $rules['current_password'] = ['required', 'current_password:api'];
+        }
+
+        $validated = $request->validate($rules);
 
         $user->password = $validated['password'];
         $user->force_password_change = false;