feat(auth,prompt-rule): add password change with session revocation and scope prompt rules by brand

Add self-service password change that re-hashes the credential and bumps a
per-user session version so all existing access/refresh tokens are rejected.
Session version is tracked in Redis with an in-memory fallback and enforced in
middleware and refresh.

Scope prompt rules and rule groups to a brand: new brand_id column (migrated to
a "未归属" fallback brand for existing rows), brand-filtered queries/indexes, and
brand-aware admin-web tabs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/shared/auth/jwt.go

@@ -43,6 +43,10 @@ type TokenPair struct {
 }
 
 func (m *Manager) Issue(userID, tenantID, primaryWorkspaceID int64, role string) (*TokenPair, error) {
+	return m.IssueWithSessionVersion(userID, tenantID, primaryWorkspaceID, role, 0)
+}
+
+func (m *Manager) IssueWithSessionVersion(userID, tenantID, primaryWorkspaceID int64, role string, sessionVersion int64) (*TokenPair, error) {
 	secret, accessTTL, refreshTTL := m.snapshot()
 	now := time.Now()
 	accessJTI := uuid.New().String()
@@ -53,6 +57,7 @@ func (m *Manager) Issue(userID, tenantID, primaryWorkspaceID int64, role string)
 		TenantID:           tenantID,
 		PrimaryWorkspaceID: primaryWorkspaceID,
 		Role:               role,
+		SessionVersion:     sessionVersion,
 		RegisteredClaims: jwt.RegisteredClaims{
 			ID:        accessJTI,
 			Subject:   "access",
@@ -70,6 +75,7 @@ func (m *Manager) Issue(userID, tenantID, primaryWorkspaceID int64, role string)
 		TenantID:           tenantID,
 		PrimaryWorkspaceID: primaryWorkspaceID,
 		Role:               role,
+		SessionVersion:     sessionVersion,
 		RegisteredClaims: jwt.RegisteredClaims{
 			ID:        refreshJTI,
 			Subject:   "refresh",