fix(auth-service): 补全 ResetPasswordDto/ChangePasswordDto 的验证装饰器

ValidationPipe 的 forbidNonWhitelisted 因缺少 class-validator 装饰器
将重置密码请求全部拒绝（400 Bad Request），导致找回密码流程无法完成。

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/services/auth-service/src/api/controllers/password.controller.ts

@@ -7,6 +7,7 @@ import {
   UseGuards,
 } from '@nestjs/common';
 import { ThrottlerGuard } from '@nestjs/throttler';
+import { IsString, IsNotEmpty, Matches, MinLength } from 'class-validator';
 import { PasswordService } from '@/application/services';
 import { JwtAuthGuard } from '@/shared/guards/jwt-auth.guard';
 import { CapabilityGuard } from '@/shared/guards/capability.guard';
@@ -14,13 +15,30 @@ import { CurrentUser } from '@/shared/decorators/current-user.decorator';
 import { RequireCapability } from '@/shared/decorators/require-capability.decorator';
 
 class ResetPasswordDto {
+  @IsString()
+  @IsNotEmpty()
+  @Matches(/^1[3-9]\d{9}$/, { message: '手机号格式不正确' })
   phone: string;
+
+  @IsString()
+  @IsNotEmpty()
+  @Matches(/^\d{6}$/, { message: '验证码格式不正确' })
   smsCode: string;
+
+  @IsString()
+  @IsNotEmpty()
+  @MinLength(6, { message: '密码至少6位' })
   newPassword: string;
 }
 
 class ChangePasswordDto {
+  @IsString()
+  @IsNotEmpty()
   oldPassword: string;
+
+  @IsString()
+  @IsNotEmpty()
+  @MinLength(6, { message: '密码至少6位' })
   newPassword: string;
 }