fix(users): a password reset signs out every session begun with the old password (#5427)

#5427 "A password reset doesn't end the sessions already signed in with
the old password": users.sessions_since (migration 0038) is set on reset;
refresh_session_user ends a session whose login_at is earlier. An admin
resetting their own password carries on signed in.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/auth/middleware.py

@@ -145,6 +145,10 @@ async def refresh_session_user() -> None:
     if user is None or not user.is_active:
         session.clear()
         return
+    # The password was reset after this session began (#5427).
+    if user.sessions_since is not None and started < user.sessions_since.timestamp():
+        session.clear()
+        return
     if session.get("user_role") != user.role.value:
         session["user_role"] = user.role.value
     # The zone times are written in (milestone 490): a change made on the