Log password change completion (currently only the reset request is logged)

[trueqap]

`LoginLogoutSensor` logs the password reset request (1003) via `retrieve_password_key`, but never the actual password change. Whether the reset link was used — or an admin/user changed a password directly — is invisible.

Proposal

Code	Event	Hook
1004	Password changed (profile update / admin)	`profile_update` with `user_pass` diff, or `after_password_reset`
1005	Password changed via reset link	`password_reset` action

Severity: HIGH. Metadata: target user, whether self-service or changed by another user.