Add a per-login session registry so users can see the browsers and devices
signed in to their account and revoke individual sessions or all other
sessions from their personal settings.
Backend:
- New user_login_session entity, migration and repository, keyed by a session
id embedded as the JWT jti claim.
- LoginSessionService owns the session lifecycle (create on login, touch on
refresh, list, revoke, revoke-all-others) and prunes expired rows on read.
- The session check is enforced in validateToken, so every auth path
(interactive, webhook cookie auth, dynamic credentials) rejects a revoked or
logged-out session. Tokens issued before this change carry no jti and fall
back to the existing checks until they expire, so no one is logged out on
upgrade.
- Password change, email change and MFA enable/disable revoke the user's other
sessions.
- /me/login-sessions endpoints (list, revoke one, revoke all others).
Frontend:
- Login sessions section in personal settings listing device, IP, last active
and sign-in time, with the current session flagged and per-row revoke plus a
revoke-all-others action.
