fix: protect password changed timestamps

[coderprepares]

Summary

• ignore passwordChangedAt during regular user updates so non-password edits cannot rewrite the password rotation timestamp
• invalidate cached /users/:id entries after email and phone password resets
• add unit and e2e coverage for both behaviors

Testing

• pnpm exec eslint src/auth/auth.controller.ts src/user/dto/update-user.dto.ts src/user/user.service.ts src/user/user.service.spec.ts test/auth-login-logout.e2e-spec.ts
• pnpm build
• pnpm test -- src/user/user.service.spec.ts
• pnpm test:e2e -- test/auth-login-logout.e2e-spec.ts

[github-actions]

sdk version 2.25.0-pr-121-f329d6669d

## for js/ts project
pnpm add @36node/auth-sdk@2.25.0-pr-121-f329d6669d

[github-actions]

sdk version 2.25.0-pr-121-8428bef64b

## for js/ts project
pnpm add @36node/auth-sdk@2.25.0-pr-121-8428bef64b