feat(auth,prompt-rule): add password change with session revocation and scope prompt rules by brand

Add self-service password change that re-hashes the credential and bumps a
per-user session version so all existing access/refresh tokens are rejected.
Session version is tracked in Redis with an in-memory fallback and enforced in
middleware and refresh.

Scope prompt rules and rule groups to a brand: new brand_id column (migrated to
a "未归属" fallback brand for existing rows), brand-filtered queries/indexes, and
brand-aware admin-web tabs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/shared/swagger/descriptions.go

@@ -23,6 +23,7 @@ var routeDocs = map[string]routeDoc{
 	"POST /api/auth/login":       {"账号密码登录", "客户后台账号密码登录，返回 access/refresh token。"},
 	"POST /api/auth/refresh":     {"刷新访问令牌", "用 refresh token 换取新的 access token。"},
 	"GET /api/auth/me":           {"当前登录用户", "返回当前 JWT 对应的用户、租户、Workspace 等会话信息。"},
+	"POST /api/auth/password":    {"修改密码", "当前登录用户修改自己的密码，成功后吊销该用户既有登录会话。"},
 	"POST /api/auth/logout":      {"退出登录", "吊销当前会话，使其 access/refresh token 立即失效。"},
 
 	// --- Public 资源 ---