fix(users): a password reset signs out every session begun with the old password (#5427)

#5427 "A password reset doesn't end the sessions already signed in with
the old password": users.sessions_since (migration 0038) is set on reset;
refresh_session_user ends a session whose login_at is earlier. An admin
resetting their own password carries on signed in.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/settings/users.py

@@ -8,6 +8,7 @@ so Steward always keeps someone who can get back in. Every change is audited.
 """
 from __future__ import annotations
 
+import time
 from datetime import datetime, timezone
 
 import bcrypt
@@ -268,7 +269,7 @@ async def user_invite_revoke(invite_id: int):
 
 
 _DONE = {"created": "Account added.", "saved": "Saved.", "role": "Role changed.",
-         "password": "Password set. It works from their next sign-in.",
+         "password": "Password set. Anywhere they were signed in, they are signed out.",
          "disabled": "Account disabled. They are signed out at their next click.",
          "enabled": "Account enabled."}
 
@@ -374,8 +375,12 @@ async def user_password(user_id: str):
                 problem = f"This account signs in with {SOURCES[user.auth_source]}; it has no Steward password."
             if problem is None:
                 user.password_hash = _hash(form.get("password"))
+                # Every browser signed in with the old password is signed out (#5427).
+                user.sessions_since = datetime.now(timezone.utc)
     if problem:
         return await _user_page(user_id, problem, 400)
+    if user_id == session.get("user_id"):
+        session["login_at"] = time.time()      # this session carries on under the new password
     await audit_request("user.password_reset", "user", user_id, {"username": user.username})
     return redirect(f"/settings/users/{user_id}?done=password")