feat: password-change hook and the reset-2FA admin slot

The D-07 password-change hook is the existing AccessRevokedEvent, fired
inside the write's transaction by a reset, the user's own change and an
administrator's password; (*AccessRevokedEvent).PasswordChanged reports
those three reasons, and the login rehash fires nothing.

The Users screen declares the record action reset_two_factor (danger)
behind the new permission golem15.users.reset_two_factor, which no role
has by default. It is offered only when a two-factor plugin publishes a
classes.TwoFactorAdmin and the user has a second factor; Run calls the
service's Reset in the action's transaction.

admin_permissions.go

@@ -16,7 +16,9 @@ const userPermissionTab = "golem15.user::lang.plugin.tab"
 // or password of a privileged-group member or delete one. The sixth
 // (classes.PermissionManageBackendLinks) has no default role either: it
 // links and unlinks another administrator's frontend account on the
-// Administrators screen.
+// Administrators screen. The seventh (classes.PermissionResetTwoFactor) has
+// no default role either: it runs the Users screen's "Reset 2FA" action,
+// which a two-factor plugin backs.
 func (*Plugin) Permissions() []pact.Permission {
 	return []pact.Permission{
 		{
@@ -53,5 +55,10 @@ func (*Plugin) Permissions() []pact.Permission {
 			Tab:   userPermissionTab,
 			Label: "golem15.user::lang.plugin.manage_backend_links",
 		},
+		{
+			Code:  classes.PermissionResetTwoFactor,
+			Tab:   userPermissionTab,
+			Label: "golem15.user::lang.plugin.reset_two_factor",
+		},
 	}
 }