testing update + docs

backend/handlers/user/profile.go

@@ -542,6 +542,12 @@ func ChangePasswordHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+
+	if req.NewPassword == req.CurrentPassword {
+		http.Error(w, "new password must be different from current password", http.StatusBadRequest)
+		return
+	}
+
 	var passwordHash string
 	err := db.DB.QueryRow(r.Context(), `SELECT password_hash FROM users WHERE id = $1`, userID).Scan(&passwordHash)
 	if err != nil {

backend/handlers/user/profile_test.go

@@ -1,6 +1,22 @@
 //go:build test
 // +build test
 
+// Package user contains tests for user profile and account management endpoints.
+//
+// Test Coverage:
+//   - GetProfileHandler: GET /api/user/profile - Get authenticated user's profile
+//   - UpdateProfileHandler: PUT /api/user/profile - Update user profile (name, phone)
+//   - ChangePasswordHandler: PUT /api/user/password - Change user password
+//   - DeleteAccountHandler: DELETE /api/user/account - Delete user account
+//   - GetLoyaltyHandler: GET /api/user/loyalty - Get user's loyalty stamps and stats
+//   - Profile picture upload: POST /api/user/profile-picture - Upload profile picture
+//
+// Authentication: All endpoints require auth (401 for unauthenticated).
+// Validation: Tests cover invalid inputs (missing fields, invalid phone, weak passwords).
+package user
+//go:build test
+// +build test
+
 package user
 
 import (