Invalidate sessions on password reset

[B58TU]

Summary

• Password reset (and password change) now bumps a per-user session_version.
• Existing signed cookie sessions that don't match are cleared on the next request, so a stolen session can't survive a reset.
• Logged-in password change keeps the current browser session alive by refreshing its version.

Test plan

• pytest tests/test_password_reset.py (includes new regression for session invalidation)
• Related auth/model suites ( est_routes, est_models_extended, est_controller_edge_cases, est_services_extended) — 67 passed
• Manually: log in two browsers, reset password via forgot-password in one, confirm the other is logged out