fix(user): revoke all sessions and access tokens on password change

- Store user password hash in session during login

- Validate password hash compatibility on requests to prevent session reuse

- Revoke all user access tokens and clear session on ChangePassword

internal/apps/oauth/constants.go

@@ -17,6 +17,7 @@ const (
 	TokenAuthKey                    = "token_auth"  // 标记当前请求是否通过 Access Token 鉴权
 	TokenAdminKey                   = "token_admin" // Access Token 本身是否具有管理员权限
 	SessionTokenKey                 = "oauth_session_token" //nolint:gosec // false positive: this is a session key, not hardcoded credentials
+	PasswordHashKey                 = "password_hash"
 )
 
 // OAuth State 缓存 Key 格式与过期时间