feat(auth,prompt-rule): add password change with session revocation and scope prompt rules by brand

Add self-service password change that re-hashes the credential and bumps a
per-user session version so all existing access/refresh tokens are rejected.
Session version is tracked in Redis with an in-memory fallback and enforced in
middleware and refresh.

Scope prompt rules and rule groups to a brand: new brand_id column (migrated to
a "未归属" fallback brand for existing rows), brand-filtered queries/indexes, and
brand-aware admin-web tabs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/shared-types/src/index.ts

@@ -28,6 +28,14 @@ export interface LoginRequest {
   email?: string
 }
 
+export interface ChangePasswordRequest {
+  old_password?: string
+  new_password?: string
+  encrypted_old_password?: string
+  encrypted_new_password?: string
+  password_key_id?: string
+}
+
 export interface PasswordPublicKeyResponse {
   key_id: string
   algorithm: 'RSA-OAEP-256'