Invalidate existing sessions on password change/reset (B-34)

Neither self-service password change nor the admin reset invalidated
already-issued JWTs — a 24h-lifetime token stayed valid regardless, so
a stolen token (or an attacker who already had the old password) kept
working past a password change meant to lock them out. The admin reset
exists precisely for the "account compromised" case and didn't evict
the attacker at all.

Add User.token_version (migration 943dbd74d983), embedded in every JWT
as a "tv" claim and checked against the DB on every request in
get_current_user/get_optional_user; a mismatch reads as session_expired.
Both change-password and the admin reset bump it. change-password hands
back a freshly minted token so the caller's own session keeps working
instead of being logged out by its own request; the admin reset does
not, since that session isn't the one making the call.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/unit/test_security.py

@@ -9,8 +9,21 @@ def test_password_hash_roundtrip():
 
 def test_jwt_roundtrip(monkeypatch):
     monkeypatch.setattr(security.settings, "jwt_secret", "test-secret")
-    token = security.create_access_token(user_id=42)
-    assert security.decode_access_token(token) == 42
+    token = security.create_access_token(user_id=42, token_version=3)
+    assert security.decode_access_token(token) == (42, 3)
+
+
+def test_jwt_decode_defaults_token_version_for_tokens_issued_before_it_existed(monkeypatch):
+    """B-34: a token minted before the "tv" claim existed has no such key at
+    all. It must still decode — as token_version 0, matching a freshly
+    migrated user's starting value — rather than raising or being treated as
+    permanently stale."""
+    import jwt as pyjwt
+
+    monkeypatch.setattr(security.settings, "jwt_secret", "test-secret")
+    payload = {"sub": "42"}
+    token = pyjwt.encode(payload, "test-secret", algorithm=security.settings.jwt_algorithm)
+    assert security.decode_access_token(token) == (42, 0)
 
 
 def test_verify_password_returns_false_for_an_unparseable_hash():