feat(auth,prompt-rule): add password change with session revocation and scope prompt rules by brand

Add self-service password change that re-hashes the credential and bumps a
per-user session version so all existing access/refresh tokens are rejected.
Session version is tracked in Redis with an in-memory fallback and enforced in
middleware and refresh.

Scope prompt rules and rule groups to a brand: new brand_id column (migrated to
a "未归属" fallback brand for existing rows), brand-filtered queries/indexes, and
brand-aware admin-web tabs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/tenant/transport/auth_handler.go

@@ -81,6 +81,25 @@ func (h *AuthHandler) Me(c *gin.Context) {
 	response.Success(c, resp)
 }
 
+func (h *AuthHandler) ChangePassword(c *gin.Context) {
+	actor, ok := auth.ActorFromCtx(c.Request.Context())
+	if !ok {
+		response.Error(c, response.ErrUnauthorized(40100, "not_authenticated", "not authenticated"))
+		return
+	}
+
+	var req app.ChangePasswordRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.Error(c, response.ErrBadRequest(40001, "invalid_params", err.Error()))
+		return
+	}
+	if err := h.svc.ChangePassword(c.Request.Context(), actor, req); err != nil {
+		response.Error(c, err)
+		return
+	}
+	response.Success(c, gin.H{"ok": true})
+}
+
 func (h *AuthHandler) Logout(c *gin.Context) {
 	header := c.GetHeader("Authorization")
 	parts := strings.SplitN(header, " ", 2)

server/internal/tenant/transport/router.go

@@ -29,6 +29,7 @@ func RegisterRoutes(app *bootstrap.App) {
 	protected.Use(middleware.BrandScope(app.DB))
 
 	protected.GET("/auth/me", authHandler.Me)
+	protected.POST("/auth/password", authHandler.ChangePassword)
 	protected.POST("/auth/logout", authHandler.Logout)
 
 	desktopClientHandler := NewDesktopClientHandler(app)
@@ -229,6 +230,7 @@ func RegisterRoutes(app *bootstrap.App) {
 
 	// Prompt Rules
 	promptRules := tenantProtected.Group("/prompt-rules")
+	promptRules.Use(middleware.RequireCurrentBrand())
 	prHandler := NewPromptRuleHandler(app)
 	promptRules.GET("", prHandler.List)
 	promptRules.GET("/simple", prHandler.ListSimple)

server/internal/tenant/transport/router_test.go

@@ -24,6 +24,7 @@ func TestProtectedRoutes_RequireAuth(t *testing.T) {
 		path   string
 	}{
 		{http.MethodGet, "/api/auth/me"},
+		{http.MethodPost, "/api/auth/password"},
 		{http.MethodPost, "/api/auth/logout"},
 		{http.MethodPost, "/api/desktop/clients/register"},
 		{http.MethodGet, "/api/tenant/accounts"},