feat(auth,prompt-rule): add password change with session revocation and scope prompt rules by brand

Add self-service password change that re-hashes the credential and bumps a
per-user session version so all existing access/refresh tokens are rejected.
Session version is tracked in Redis with an in-memory fallback and enforced in
middleware and refresh.

Scope prompt rules and rule groups to a brand: new brand_id column (migrated to
a "未归属" fallback brand for existing rows), brand-filtered queries/indexes, and
brand-aware admin-web tabs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/shared/auth/middleware_test.go

@@ -123,3 +123,23 @@ func TestAuthMiddleware_BlacklistedToken(t *testing.T) {
 
 	assert.Equal(t, http.StatusUnauthorized, w.Code)
 }
+
+func TestAuthMiddleware_StaleSessionVersionRejected(t *testing.T) {
+	mgr, sessions, _ := setupTestMiddleware(t)
+
+	pair, err := mgr.IssueWithSessionVersion(1, 10, 100, "editor", 0)
+	require.NoError(t, err)
+	_, err = sessions.BumpSessionVersion(t.Context(), 1)
+	require.NoError(t, err)
+
+	r := gin.New()
+	r.Use(Middleware(mgr, sessions))
+	r.GET("/test", func(c *gin.Context) { c.Status(http.StatusOK) })
+
+	w := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/test", nil)
+	req.Header.Set("Authorization", "Bearer "+pair.AccessToken)
+	r.ServeHTTP(w, req)
+
+	assert.Equal(t, http.StatusUnauthorized, w.Code)
+}