fix(users): a password reset signs out every session begun with the old password (#5427)

#5427 "A password reset doesn't end the sessions already signed in with
the old password": users.sessions_since (migration 0038) is set on reset;
refresh_session_user ends a session whose login_at is earlier. An admin
resetting their own password carries on signed in.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/integration/test_users_page.py

@@ -161,6 +161,33 @@ def test_a_provider_account_s_role_is_not_edited_here(app):
     asyncio.run(_go())
 
 
+def test_a_password_reset_signs_out_the_old_sessions_but_not_the_admin_s_own(app):
+    """#5427: a browser signed in before the reset is signed out; the admin
+    who resets their own password stays signed in."""
+    async def _go():
+        admin, me = await _client(app)
+        them, uid = await _client(app, role="viewer")
+        async with them.session_transaction() as sess:
+            sess["login_at"] = time.time() - 60          # signed in a minute ago
+        assert (await them.get("/account/")).status_code == 200
+
+        resp = await admin.post(f"/settings/users/{uid}/password", headers=CSRF,
+                                form={"password": "battery staple", "confirm": "battery staple"})
+        assert resp.status_code == 302 and "signed out" in await (await admin.get(resp.headers["Location"])).get_data(as_text=True)
+        assert (await them.get("/account/")).status_code == 302          # back to sign-in
+        async with them.session_transaction() as sess:
+            assert "user_id" not in sess
+
+        async with admin.session_transaction() as sess:
+            sess["login_at"] = time.time() - 60
+        resp = await admin.post(f"/settings/users/{me}/password", headers=CSRF,
+                                form={"password": "my own new one", "confirm": "my own new one"})
+        assert resp.status_code == 302
+        assert (await admin.get("/account/")).status_code == 200         # still signed in
+
+    asyncio.run(_go())
+
+
 def test_only_an_admin_reaches_users(app):
     async def _go():
         client, _ = await _client(app, role="operator")