fix: improve authentication reliability and account compatibility

Resolve bugs in internal authentication handling and improve consistency across supported account flows.

Maintain compatibility with existing accounts while preserving user data and established client behavior.

Validation: TypeScript checks, production build, and Worker packaging checks passed.

src/services/storage-user-repo.ts

@@ -113,6 +113,21 @@ export async function createUser(db: D1Database, safeBind: SafeBind, user: User)
   await saveUser(db, safeBind, user);
 }
 
+export async function upgradePasswordVerifier(
+  db: D1Database,
+  userId: string,
+  expectedVerifier: string,
+  securityStamp: string,
+  newVerifier: string
+): Promise<boolean> {
+  // Update only the verifier, preserving vault keys, timestamps and sessions.
+  // A concurrent password change, disable or delete must not be overwritten.
+  const result = await db.prepare(
+    "UPDATE users SET master_password_hash = ? WHERE id = ? AND master_password_hash = ? AND security_stamp = ? AND status = 'active'"
+  ).bind(newVerifier, userId, expectedVerifier, securityStamp).run();
+  return (result.meta.changes ?? 0) > 0;
+}
+
 export async function createFirstUser(db: D1Database, safeBind: SafeBind, user: User): Promise<boolean> {
   const email = user.email.toLowerCase();
   const stmt = db.prepare(