fix: invalidate user cache after password update

[coderprepares]

Summary

• invalidate the cached user detail entry when POST /users/:userId/@updatePassword succeeds
• use /users/:userId as the cache key so 204 responses can still delete the concrete cache entry
• keep password rotation reads aligned with the latest passwordChangedAt

Testing

• pnpm exec eslint src/user/user.controller.ts
• pnpm build
• pnpm test
• verified locally that GET /users/:id returns the new passwordChangedAt immediately after @updatePassword