feat(auth,prompt-rule): add password change with session revocation and scope prompt rules by brand

Add self-service password change that re-hashes the credential and bumps a
per-user session version so all existing access/refresh tokens are rejected.
Session version is tracked in Redis with an in-memory fallback and enforced in
middleware and refresh.

Scope prompt rules and rule groups to a brand: new brand_id column (migrated to
a "未归属" fallback brand for existing rows), brand-filtered queries/indexes, and
brand-aware admin-web tabs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/admin-web/src/i18n/messages/en-US.ts

@@ -140,6 +140,16 @@ const enUS = {
     currentCompany: 'Company',
     currentCompanyPlaceholder: 'Select company',
     createCompany: 'Create company',
+    changePassword: 'Change password',
+    changePasswordTitle: 'Change password',
+    oldPassword: 'Current password',
+    newPassword: 'New password',
+    confirmNewPassword: 'Confirm new password',
+    passwordMinHint: 'At least 8 characters',
+    passwordValidation:
+      'Enter your current password and set the new password to at least 8 characters.',
+    passwordMismatch: 'The new passwords do not match.',
+    passwordChanged: 'Password updated. Please sign in again with the new password.',
     openNavigation: 'Open navigation',
     collapseNavigation: 'Collapse navigation',
     expandNavigation: 'Expand navigation',

apps/admin-web/src/i18n/messages/zh-CN.ts

@@ -137,6 +137,15 @@ const zhCN = {
     currentCompany: "当前公司",
     currentCompanyPlaceholder: "选择公司",
     createCompany: "创建公司",
+    changePassword: "修改密码",
+    changePasswordTitle: "修改密码",
+    oldPassword: "原密码",
+    newPassword: "新密码",
+    confirmNewPassword: "确认新密码",
+    passwordMinHint: "至少 8 位",
+    passwordValidation: "请输入原密码，并将新密码设为至少 8 位",
+    passwordMismatch: "两次输入的新密码不一致",
+    passwordChanged: "密码已更新，请使用新密码重新登录",
     openNavigation: "打开导航",
     collapseNavigation: "收起导航",
     expandNavigation: "展开导航",