feat: password-change hook and the reset-2FA admin slot

The D-07 password-change hook is the existing AccessRevokedEvent, fired
inside the write's transaction by a reset, the user's own change and an
administrator's password; (*AccessRevokedEvent).PasswordChanged reports
those three reasons, and the login rehash fires nothing.

The Users screen declares the record action reset_two_factor (danger)
behind the new permission golem15.users.reset_two_factor, which no role
has by default. It is offered only when a two-factor plugin publishes a
classes.TwoFactorAdmin and the user has a second factor; Run calls the
service's Reset in the action's transaction.

admin_users_edge_test.go

@@ -250,6 +250,14 @@ func TestAdminUsersControllerGuards(t *testing.T) {
 				if action.Name == "activate" {
 					continue // reads the record only
 				}
+				if action.Name == "reset_two_factor" {
+					// No classes.TwoFactorAdmin is published, so it reads
+					// nothing and is simply not offered.
+					if applies, err := action.Applies(ctx, user); applies || err != nil {
+						t.Fatalf("applies reset_two_factor without a service = %v, %v", applies, err)
+					}
+					continue
+				}
 				_, err := action.Applies(ctx, user)
 				wantPlainError(t, "applies "+action.Name, err)
 			}