Rifiuta il riuso della password attuale in cambio e reset.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/spec/models/password_complexity_spec.rb

@@ -21,6 +21,15 @@ RSpec.describe PasswordComplexity do
     end
   end
 
+  describe ".same_as_current?" do
+    let!(:user) { User.create!(email: "same@example.com", name: "Same", password: "Password123", role: "coach") }
+
+    it "detects when the new password matches the current one" do
+      expect(described_class.same_as_current?(user, "Password123")).to eq(true)
+      expect(described_class.same_as_current?(user, "OtherPass123")).to eq(false)
+    end
+  end
+
   describe "User validation" do
     it "blocks weak passwords on create" do
       user = User.new(email: "weak@example.com", name: "Weak", password: "password123", role: "coach")

backend/spec/requests/account_spec.rb

@@ -73,6 +73,19 @@ RSpec.describe "Account API", type: :request do
       expect(JSON.parse(response.body)["error"]).to match(/3 of/i)
       expect(user.reload.authenticate("Password123")).to be_truthy
     end
+
+    it "rejects reusing the current password" do
+      patch "/api/v1/account/password",
+            params: {
+              current_password: "Password123",
+              password: "Password123",
+              password_confirmation: "Password123"
+            },
+            headers: auth_headers
+      expect(response).to have_http_status(:unprocessable_entity)
+      expect(JSON.parse(response.body)["error"]).to match(/different/i)
+      expect(user.reload.authenticate("Password123")).to be_truthy
+    end
   end
 
   describe "POST /api/v1/auth/password/forgot" do