Invalidate existing sessions on password change/reset (B-34)

Neither self-service password change nor the admin reset invalidated
already-issued JWTs — a 24h-lifetime token stayed valid regardless, so
a stolen token (or an attacker who already had the old password) kept
working past a password change meant to lock them out. The admin reset
exists precisely for the "account compromised" case and didn't evict
the attacker at all.

Add User.token_version (migration 943dbd74d983), embedded in every JWT
as a "tv" claim and checked against the DB on every request in
get_current_user/get_optional_user; a mismatch reads as session_expired.
Both change-password and the admin reset bump it. change-password hands
back a freshly minted token so the caller's own session keeps working
instead of being logged out by its own request; the admin reset does
not, since that session isn't the one making the call.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/unit/test_users.py

@@ -81,7 +81,8 @@ async def test_change_password_updates_login(client):
         headers=headers,
         json={"current_password": "original-password", "new_password": "brand-new-password"},
     )
-    assert resp.status_code == 204
+    assert resp.status_code == 200
+    assert resp.json()["access_token"]
 
     resp = await client.post("/auth/login", json={"username": "alice", "password": "original-password"})
     assert resp.status_code == 401
@@ -90,6 +91,36 @@ async def test_change_password_updates_login(client):
     assert resp.status_code == 200
 
 
+async def test_change_password_invalidates_the_old_token_but_not_the_new_one(client):
+    """B-34: neither self-service change-password nor the admin reset used to
+    invalidate already-issued JWTs, so a stolen token (or an attacker who
+    already had the old password) stayed logged in until the token's natural
+    24h expiry — even past a password change meant to lock them out."""
+    old_token = await _register(client)
+    old_headers = {"Authorization": f"Bearer {old_token}"}
+
+    resp = await client.post(
+        "/users/me/change-password",
+        headers=old_headers,
+        json={"current_password": "original-password", "new_password": "brand-new-password"},
+    )
+    assert resp.status_code == 200
+    new_token = resp.json()["access_token"]
+    assert new_token != old_token
+
+    # The old token (what an attacker holding the old password would still
+    # have) is now rejected...
+    resp = await client.get("/users/me", headers=old_headers)
+    assert resp.status_code == 401
+    assert resp.json()["detail"]["code"] == "session_expired"
+
+    # ...but the freshly issued one keeps this same session working, so the
+    # user who just changed their own password isn't logged out too.
+    new_headers = {"Authorization": f"Bearer {new_token}"}
+    resp = await client.get("/users/me", headers=new_headers)
+    assert resp.status_code == 200
+
+
 async def test_change_password_rejects_too_short(client):
     token = await _register(client)
     headers = {"Authorization": f"Bearer {token}"}