Password-change inputs have explicit themed surfaces, persistent labels and adequate line height, while remaining masked. The action and dialog require authenticated confirmation that a local Snag password exists. OAuth-only or unknown status stays hidden; mixed accounts with a local password retain it.

App PR: https://github.com/snag-tcg/poc-tcg-collector/pull/962. API companion: https://github.com/snag-tcg/tcg-collector-backend/pull/612. GET /me/password returns a private/no-store hasPassword boolean using EXISTS, without selecting hashes or disclosing provider identities. No migration needed. Deploy the API before the app: old/unavailable endpoints yield unknown capability.

Focused mobile/account tests: 48 passed. Focused API: 12 passed, 1 optional SQL fixture skipped. Full repository outcomes are recorded on the PRs. A device flow is prepared but not run. No emulator, deployment, password change, account or collection mutation was performed; work ran on the personal VPS.

Each of the three password-change fields also has an independent accessible eye toggle. Icons alternate between eye and eye-slash. Values start masked and reset to masked when the editor is cleared/reopened. The touch targets are 44px and disabled during submission. Focused account/client regression count is now 49. The read-only Maestro flow covers the visibility buttons but has not been run.