feat(auth,prompt-rule): add password change with session revocation and scope prompt rules by brand

Add self-service password change that re-hashes the credential and bumps a
per-user session version so all existing access/refresh tokens are rejected.
Session version is tracked in Redis with an in-memory fallback and enforced in
middleware and refresh.

Scope prompt rules and rule groups to a brand: new brand_id column (migrated to
a "未归属" fallback brand for existing rows), brand-filtered queries/indexes, and
brand-aware admin-web tabs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/tenant/repository/auth_repo.go

@@ -34,6 +34,7 @@ type AuthRepository interface {
 	GetUserByEmail(ctx context.Context, email string) (*UserRecord, error)
 	GetUserByLoginIdentifier(ctx context.Context, identifier string) (*UserRecord, error)
 	GetUserByID(ctx context.Context, id int64) (*UserRecord, error)
+	UpdateUserPassword(ctx context.Context, id int64, passwordHash string) error
 	GetTenantMembership(ctx context.Context, userID int64) (*MembershipRecord, error)
 	GetTenantMembershipByTenantAndUser(ctx context.Context, tenantID, userID int64) (*MembershipRecord, error)
 }
@@ -103,6 +104,13 @@ func (r *authRepository) GetUserByID(ctx context.Context, id int64) (*UserRecord
 	}, nil
 }
 
+func (r *authRepository) UpdateUserPassword(ctx context.Context, id int64, passwordHash string) error {
+	return r.q.UpdateUserPassword(ctx, generated.UpdateUserPasswordParams{
+		ID:           id,
+		PasswordHash: passwordHash,
+	})
+}
+
 func (r *authRepository) GetTenantMembership(ctx context.Context, userID int64) (*MembershipRecord, error) {
 	row, err := r.q.GetTenantMembership(ctx, userID)
 	if err != nil {