Auth Password Verify Create

Step-up sudo re-auth — Phase 4 of the staff step-up auth rollout.

Caller is already JWT-authenticated. They submit their password to refresh the "recently verified" cache flag that Phase 5's POST /auth/scope-up/ reads as its gate before minting an elevated JWT.

No JWT issued, no permission changed, no user state mutated — the side effect is one Redis SET with a 5-minute TTL.

See implementation_logs/security/staff_step_up_auth_design.md §5.