feat(auth,prompt-rule): add password change with session revocation and scope prompt rules by brand

Add self-service password change that re-hashes the credential and bumps a
per-user session version so all existing access/refresh tokens are rejected.
Session version is tracked in Redis with an in-memory fallback and enforced in
middleware and refresh.

Scope prompt rules and rule groups to a brand: new brand_id column (migrated to
a "未归属" fallback brand for existing rows), brand-filtered queries/indexes, and
brand-aware admin-web tabs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/admin-web/src/lib/api.ts

@@ -11,6 +11,7 @@ import type {
   Brand,
   BrandLibrarySummary,
   BrandRequest,
+  ChangePasswordRequest,
   Competitor,
   CompetitorRequest,
   ComplianceAckRecord,
@@ -322,6 +323,7 @@ const currentBrandScopedPathPatterns = [
   /^\/api\/tenant\/instant-tasks(?:\/|$)/,
   /^\/api\/tenant\/publish-jobs(?:\/|$)/,
   /^\/api\/tenant\/publish-tasks\/[^/]+\/retry(?:\/|$)/,
+  /^\/api\/tenant\/prompt-rules(?:\/|$)/,
 ]
 
 function shouldAttachCurrentBrandHeader(url: unknown): boolean {
@@ -406,6 +408,9 @@ export const authApi = {
   me() {
     return apiClient.get<UserInfo>('/api/auth/me')
   },
+  changePassword(payload: ChangePasswordRequest) {
+    return apiClient.post<{ ok: boolean }, ChangePasswordRequest>('/api/auth/password', payload)
+  },
   logout() {
     return apiClient.post<null>('/api/auth/logout')
   },