feat(auth,prompt-rule): add password change with session revocation and scope prompt rules by brand

Add self-service password change that re-hashes the credential and bumps a
per-user session version so all existing access/refresh tokens are rejected.
Session version is tracked in Redis with an in-memory fallback and enforced in
middleware and refresh.

Scope prompt rules and rule groups to a brand: new brand_id column (migrated to
a "未归属" fallback brand for existing rows), brand-filtered queries/indexes, and
brand-aware admin-web tabs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/admin-web/src/lib/errors.ts

@@ -15,6 +15,8 @@ const authSessionErrorMessages = new Set([
 
 const errorMessageMap: Record<string, string> = {
   invalid_credentials: '邮箱或密码错误',
+  invalid_old_password: '原密码错误',
+  weak_password: '新密码至少 8 位',
   login_rate_limited: '登录请求过于频繁',
   login_locked: '登录已被临时保护',
   login_in_progress: '登录请求正在处理中',