fix(iam): separate password changes and refresh coordinated SDK dependencies

Use ChangeMyPassword for the authenticated user and keep CreateUser for other users. Coordinate silo-pkg b3760f56ec23, mcli fa22b40b4eb7, Console 1b95b6cec652 and upstream minio-go 78bfa91607c2. Add legacy-policy and SDK streaming regressions plus upgrade guidance.

Signed-off-by: Feng Ruohang <rh@vonng.com>

cmd/sdk-streaming-signature_test.go

@@ -0,0 +1,64 @@
+// Copyright (c) 2026 Feng Ruohang
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+package cmd
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"hash"
+	"net/http"
+	"net/http/httptest"
+	"slices"
+	"strings"
+	"testing"
+
+	"github.com/minio/minio-go/v7/pkg/signer"
+	"github.com/minio/minio/internal/auth"
+)
+
+type sdkStreamingHasher struct{ hash.Hash }
+
+func (sdkStreamingHasher) Close() {}
+
+func TestAPIUpstreamSDKStreamingContentType(t *testing.T) {
+	ExecObjectLayerAPITest(ExecObjectLayerAPITestArgs{
+		t: t,
+		objAPITest: func(obj ObjectLayer, instanceType, bucketName string, router http.Handler, cred auth.Credentials, t *testing.T) {
+			payload := bytes.Repeat([]byte("sdk-streaming-"), 8192)
+			for _, tamper := range []bool{false, true} {
+				req, err := http.NewRequest(http.MethodPut, getPutObjectURL("http://localhost", bucketName, "sdk-streaming"), bytes.NewReader(payload))
+				if err != nil {
+					t.Fatal(err)
+				}
+				req.Header.Set("Content-Type", "application/x-silo-test")
+				hasher := sdkStreamingHasher{sha256.New()}
+				req = signer.StreamingSignV4(req, cred.AccessKey, cred.SecretKey, "", globalSite.Region(), int64(len(payload)), UTCNow(), hasher)
+				_, signedHeaders, _ := strings.Cut(req.Header.Get("Authorization"), "SignedHeaders=")
+				signedHeaders, _, _ = strings.Cut(signedHeaders, ",")
+				if !slices.Contains(strings.Split(signedHeaders, ";"), "content-type") {
+					t.Fatal("upstream SDK did not sign Content-Type")
+				}
+				if tamper {
+					req.Header.Set("Content-Type", "application/x-tampered")
+				}
+				rec := httptest.NewRecorder()
+				router.ServeHTTP(rec, req)
+				want := http.StatusOK
+				if tamper {
+					want = http.StatusForbidden
+				}
+				if rec.Code != want {
+					t.Fatalf("%s tamper=%v: status %d, want %d: %s", instanceType, tamper, rec.Code, want, rec.Body.String())
+				}
+			}
+			info, err := obj.GetObjectInfo(t.Context(), bucketName, "sdk-streaming", ObjectOptions{})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if info.Size != int64(len(payload)) || info.ContentType != "application/x-silo-test" {
+				t.Fatalf("stored size/type = %d/%q", info.Size, info.ContentType)
+			}
+		},
+	})
+}