feat(auth,prompt-rule): add password change with session revocation and scope prompt rules by brand

Add self-service password change that re-hashes the credential and bumps a
per-user session version so all existing access/refresh tokens are rejected.
Session version is tracked in Redis with an in-memory fallback and enforced in
middleware and refresh.

Scope prompt rules and rule groups to a brand: new brand_id column (migrated to
a "未归属" fallback brand for existing rows), brand-filtered queries/indexes, and
brand-aware admin-web tabs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/admin-web/src/components/InstantTaskTab.vue

@@ -41,7 +41,8 @@ const appliedFilters = reactive<{
 })
 
 const rulesQuery = useQuery({
-  queryKey: ['promptRules', 'simple'],
+  queryKey: computed(() => ['promptRules', 'simple', companyStore.currentBrandId]),
+  enabled: computed(() => Boolean(companyStore.currentBrandId)),
   queryFn: () => promptRulesApi.listSimple(),
 })
 
@@ -175,6 +176,15 @@ watch(
   { immediate: true },
 )
 
+watch(
+  () => companyStore.currentBrandId,
+  () => {
+    draftFilters.prompt_rule_id = undefined
+    appliedFilters.prompt_rule_id = undefined
+    page.value = 1
+  },
+)
+
 onBeforeUnmount(() => {
   stopPolling()
 })