fix(auth): Provide sessionVerified on passwordChange handler

[nshirley]

Because

• There's a bug where a user can get signed out after changing their password

This pull request

• Includes the sessionVerified property that updateBasicAccountData looks for.

Issue that this pull request solves

Closes: FXA-13355

Checklist

Put an x in the boxes that apply

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).
• I have manually reviewed all AI generated code.

How to review (Optional)

• Key files/areas to focus on:
• Suggested review order:
• Risky or complex parts:

Screenshots (Optional)

Please attach the screenshots of the changes made in case of change in user interface.

Other information (Optional)

Any other information that is important to this pull request.

[Copilot]

Pull request overview

Fixes a regression where clients could treat the post-password-change session as unverified (and sign the user out) by ensuring the /mfa/password/change response includes the sessionVerified flag that downstream account storage expects (Closes: FXA-13355).

Changes:

• Add sessionVerified to the /mfa/password/change route response, sourced from the newly issued session token’s verification state.
• Add/adjust unit tests to assert sessionVerified is present and consistent with the legacy verified field.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
packages/fxa-auth-server/lib/routes/password.ts	Include sessionVerified in the password change response payload.
packages/fxa-auth-server/lib/routes/password.spec.ts	Add a test ensuring sessionVerified is returned (and keep formatting tidy in an existing assertion).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[vbudhram]

Could add a functional test in passwordless to cover the flow

[nshirley]

Latest force push was adding a functional test for this bug!