Ask for the new password twice

Changing your own password had one input for it. Nothing can be read back,
and unlike the current password it has never been typed before, so a typo
saves silently and locks you out of an account you could reach a moment
earlier. The only way back is an admin reset.

The admin's reset of someone else's password is untouched: that is the
recovery path, not a self-service change.

src/templates/profile.html

@@ -50,6 +50,8 @@
     <label>Kuva <input type="file" name="avatar" accept="image/*"></label>
     <label>Nykyinen salasana <input type="password" name="current_password" autocomplete="current-password"></label>
     <label>Uusi salasana <input type="password" name="new_password" autocomplete="new-password"></label>
+    <!-- Neither field can be read back, and the new password has never been typed before. -->
+    <label>Toista uusi salasana <input type="password" name="new_password_repeat" autocomplete="new-password"></label>
     <button type="submit">Tallenna</button>
   </form>
   <p class="muted small">Salasanan vaihto vaatii nykyisen salasanan ja kirjaa ulos muut laitteesi.</p>