feat: password-change hook and the reset-2FA admin slot

The D-07 password-change hook is the existing AccessRevokedEvent, fired
inside the write's transaction by a reset, the user's own change and an
administrator's password; (*AccessRevokedEvent).PasswordChanged reports
those three reasons, and the login rehash fires nothing.

The Users screen declares the record action reset_two_factor (danger)
behind the new permission golem15.users.reset_two_factor, which no role
has by default. It is offered only when a two-factor plugin publishes a
classes.TwoFactorAdmin and the user has a second factor; Run calls the
service's Reset in the action's transaction.

classes/events.go

@@ -116,6 +116,24 @@ type AccessRevokedEvent struct {
 	Tx      *gorm.DB
 }
 
+// PasswordChanged reports whether the event comes from a new password the
+// user or an administrator chose: a password reset, the user's own change or
+// an administrator setting one (Reason AccessRevokedPasswordReset,
+// AccessRevokedPasswordChanged or AccessRevokedPasswordSetByAdmin). The
+// bcrypt rehash on login and a new account fire no AccessRevokedEvent. A
+// two-factor plugin listens for these events to revoke the users' trusted
+// devices inside the same transaction.
+func (e *AccessRevokedEvent) PasswordChanged() bool {
+	if e == nil {
+		return false
+	}
+	switch e.Reason {
+	case AccessRevokedPasswordReset, AccessRevokedPasswordChanged, AccessRevokedPasswordSetByAdmin:
+		return true
+	}
+	return false
+}
+
 // LoginEvent fires after a sign-in issued a session token: a password login,
 // a sign-in completed by a second factor, a passkey sign-in or a device
 // hand-over (Source is one of the LoginSource constants). It does not fire