Ricardo Espinoza 2177fe1d89 feat(core): Add login session management ... Add a per-login session registry so users can see the browsers and devices signed in to their account and revoke individual sessions or all other sessions from their personal settings. Backend: - New user_login_session entity, migration and repository, keyed by a session id embedded as the JWT jti claim. - LoginSessionService owns the session lifecycle (create on login, touch on refresh, list, revoke, revoke-all-others) and prunes expired rows on read. - The session check is enforced in validateToken, so every auth path (interactive, webhook cookie auth, dynamic credentials) rejects a revoked or logged-out session. Tokens issued before this change carry no jti and fall back to the existing checks until they expire, so no one is logged out on upgrade. - Password change, email change and MFA enable/disable revoke the user's other sessions. - /me/login-sessions endpoints (list, revoke one, revoke all others). Frontend: - Login sessions section in personal settings listing device, IP, last active and sign-in time, with the current session flagged and per-row revoke plus a revoke-all-others action.		2026-07-01 17:28:11 -04:00
..
generated	feat(core): Add login session management	2026-07-01 17:28:11 -04:00
db.md	feat(core): Add auto-generated database schema documentation (no-changelog) (#32069)	2026-06-12 07:44:01 +00:00