feat: password-change hook and the reset-2FA admin slot

The D-07 password-change hook is the existing AccessRevokedEvent, fired
inside the write's transaction by a reset, the user's own change and an
administrator's password; (*AccessRevokedEvent).PasswordChanged reports
those three reasons, and the login rehash fires nothing.

The Users screen declares the record action reset_two_factor (danger)
behind the new permission golem15.users.reset_two_factor, which no role
has by default. It is offered only when a two-factor plugin publishes a
classes.TwoFactorAdmin and the user has a second factor; Run calls the
service's Reset in the action's transaction.

admin_users_test.go

@@ -50,6 +50,7 @@ func TestAdminUsersTracer(t *testing.T) {
 		"golem15.users.access_users@developer", "golem15.users.access_groups@developer",
 		"golem15.users.access_settings@developer", "golem15.users.impersonate_user@developer",
 		classes.PermissionManagePrivilegedGroups + "@-", classes.PermissionManageBackendLinks + "@-",
+		classes.PermissionResetTwoFactor + "@-",
 	}; !reflect.DeepEqual(codes, want) || classes.PermissionManagePrivilegedGroups != permManagePrivileged {
 		t.Fatalf("permissions = %v", codes)
 	}
@@ -610,7 +611,7 @@ func TestAdminUserActions(t *testing.T) {
 			registered = append(registered, action.Name)
 		}
 	}
-	if want := []string{"activate", "unban", "unsuspend"}; !reflect.DeepEqual(registered, want) {
+	if want := []string{"activate", "unban", "unsuspend", "reset_two_factor"}; !reflect.DeepEqual(registered, want) {
 		t.Fatalf("record actions = %v, want %v", registered, want)
 	}
 	var form struct {