Auth Password Verify Create

Step-up sudo re-auth — Phase 4 of the staff step-up auth rollout. Caller is already JWT-authenticated. They submit their password to refresh the "recently verified" cache flag that Phase 5's ``POST /auth/scope-up/`` reads as its gate before minting an elevated JWT. No JWT issued, no permission changed, no user state mutated — the side effect is one Redis SET with a 5-minute TTL. See implementation_logs/security/staff_step_up_auth_design.md §5.