feat(auth,prompt-rule): add password change with session revocation and scope prompt rules by brand

Add self-service password change that re-hashes the credential and bumps a
per-user session version so all existing access/refresh tokens are rejected.
Session version is tracked in Redis with an in-memory fallback and enforced in
middleware and refresh.

Scope prompt rules and rule groups to a brand: new brand_id column (migrated to
a "未归属" fallback brand for existing rows), brand-filtered queries/indexes, and
brand-aware admin-web tabs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/tenant/app/prompt_generate_service.go

@@ -267,7 +267,7 @@ func (s *PromptRuleGenerationService) enqueuePromptRuleGeneration(ctx context.Co
 		return nil, response.ErrBadRequest(40033, "brand_context_required", "current brand is required")
 	}
 
-	rule, err := s.loadPromptRule(ctx, input.TenantID, input.PromptRuleID)
+	rule, err := s.loadPromptRule(ctx, input.TenantID, *input.BrandID, input.PromptRuleID)
 	if err != nil {
 		return nil, err
 	}
@@ -476,13 +476,13 @@ func (s *PromptRuleGenerationService) enqueuePromptRuleGeneration(ctx context.Co
 	return &GenerateFromRuleResponse{ArticleID: articleID, TaskID: taskID}, nil
 }
 
-func (s *PromptRuleGenerationService) loadPromptRule(ctx context.Context, tenantID, promptRuleID int64) (*promptRuleGenerationRecord, error) {
+func (s *PromptRuleGenerationService) loadPromptRule(ctx context.Context, tenantID, brandID, promptRuleID int64) (*promptRuleGenerationRecord, error) {
 	record := &promptRuleGenerationRecord{}
 	err := s.pool.QueryRow(ctx, `
 		SELECT id, name, prompt_content, scene, default_tone, default_word_count, status
 		FROM prompt_rules
-		WHERE id = $1 AND tenant_id = $2 AND deleted_at IS NULL
-	`, promptRuleID, tenantID).Scan(
+		WHERE id = $1 AND tenant_id = $2 AND brand_id = $3 AND deleted_at IS NULL
+	`, promptRuleID, tenantID, brandID).Scan(
 		&record.ID,
 		&record.Name,
 		&record.PromptContent,