fix(audit-wave-11): auth-flow hardening (auth-flow-auditor)

Address the two CRITICAL items from auth-flow-auditor plus the
high-impact M10 open-redirect.

**C1 — Password reset doesn't revoke existing sessions**

CRM side: Better Auth has a built-in
`emailAndPassword.revokeSessionsOnPasswordReset` flag — flip it on.
Verified by reading password.mjs in node_modules/better-auth: this
calls `internalAdapter.deleteSessions(userId)` after the password
update commits. One-line fix, closes the canonical session-bumping
gap on the CRM forgot-password flow.

Portal side: the portal uses JWT sessions (not DB-side rows) so
there's no `deleteSessions` to call. Add a per-user
`password_changed_at` watermark column on `portal_users` and have
`verifyPortalToken` reject any token whose `iat` predates the
watermark. Updated on `resetPassword`, `changePortalPassword`, and
`activateAccount` so every password mutation revokes outstanding
cookies. Token shape gains a required `portalUserId` claim so the
verify step can do the watermark lookup without an email-based join;
legacy tokens (pre-Wave-11) lack it and are rejected → forces one
re-login per portal user post-deploy (24h max delay since portal
tokens already self-expire at 24h).

Migration `0058_portal_password_revocation.sql` stamps existing
rows to `now()` so no current session is invalidated by the schema
change itself.

**M10 — Portal login `?next=` open redirect**

`portal/login/page.tsx` did `router.replace(next as never)` against
unvalidated `searchParams.get('next')`. An attacker could send a
victim to `/portal/login?next=https://evil.example` and the post-sign-in
redirect would navigate cross-site. Add `safeNextPath()` that requires
`/portal/...` prefix and rejects protocol-relative URLs; everything
else falls back to `/portal/dashboard`.

**Other auth-flow items confirmed resolved by earlier waves:**
- H6 resolve-identifier enumeration: endpoint deleted in Wave 1
  (replaced with sign-in-by-identifier which keeps the synthetic
  email behind a server-side proxy)

Tests updated: portal-auth integration test mocks `db` so the new
DB-watermark lookup in `verifyPortalToken` stays unit-pure.

Tests 1315/1315 after `psql ALTER TABLE` to apply migration locally.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/services/portal-auth.service.ts

@@ -221,7 +221,7 @@ export async function changePortalPassword(args: {
   const passwordHash = await hashPassword(args.newPassword);
   await db
     .update(portalUsers)
-    .set({ passwordHash, updatedAt: new Date() })
+    .set({ passwordHash, passwordChangedAt: new Date(), updatedAt: new Date() })
     .where(eq(portalUsers.id, user.id));
 
   void createAuditLog({
@@ -253,7 +253,7 @@ export async function activateAccount(rawToken: string, password: string): Promi
   const passwordHash = await hashPassword(password);
   await db
     .update(portalUsers)
-    .set({ passwordHash, updatedAt: new Date() })
+    .set({ passwordHash, passwordChangedAt: new Date(), updatedAt: new Date() })
     .where(eq(portalUsers.id, tokenRow.portalUserId));
 
   void createAuditLog({
@@ -320,6 +320,7 @@ export async function signIn(args: {
   }
 
   const token = await createPortalToken({
+    portalUserId: user.id,
     clientId: user.clientId,
     portId: user.portId,
     email: user.email,
@@ -440,7 +441,7 @@ export async function resetPassword(rawToken: string, password: string): Promise
   const passwordHash = await hashPassword(password);
   await db
     .update(portalUsers)
-    .set({ passwordHash, updatedAt: new Date() })
+    .set({ passwordHash, passwordChangedAt: new Date(), updatedAt: new Date() })
     .where(eq(portalUsers.id, tokenRow.portalUserId));
 
   void createAuditLog({