feat(auth,prompt-rule): add password change with session revocation and scope prompt rules by brand

Add self-service password change that re-hashes the credential and bumps a
per-user session version so all existing access/refresh tokens are rejected.
Session version is tracked in Redis with an in-memory fallback and enforced in
middleware and refresh.

Scope prompt rules and rule groups to a brand: new brand_id column (migrated to
a "未归属" fallback brand for existing rows), brand-filtered queries/indexes, and
brand-aware admin-web tabs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/shared/auth/jwt_test.go

@@ -27,6 +27,7 @@ func TestIssueAndParse(t *testing.T) {
 	assert.Equal(t, "tenant_admin", claims.Role)
 	assert.Equal(t, "access", claims.Subject)
 	assert.Equal(t, pair.AccessJTI, claims.ID)
+	assert.Equal(t, int64(0), claims.SessionVersion)
 }
 
 func TestParseRefreshToken(t *testing.T) {
@@ -41,6 +42,21 @@ func TestParseRefreshToken(t *testing.T) {
 	assert.Equal(t, pair.RefreshJTI, claims.ID)
 }
 
+func TestIssueWithSessionVersion(t *testing.T) {
+	mgr := NewManager("test-secret-key", 15*time.Minute, 7*24*time.Hour)
+
+	pair, err := mgr.IssueWithSessionVersion(1, 1, 10, "viewer", 3)
+	require.NoError(t, err)
+
+	accessClaims, err := mgr.Parse(pair.AccessToken)
+	require.NoError(t, err)
+	assert.Equal(t, int64(3), accessClaims.SessionVersion)
+
+	refreshClaims, err := mgr.Parse(pair.RefreshToken)
+	require.NoError(t, err)
+	assert.Equal(t, int64(3), refreshClaims.SessionVersion)
+}
+
 func TestParseExpired(t *testing.T) {
 	mgr := NewManager("test-secret-key", -1*time.Second, -1*time.Second)