fix(users): a password reset signs out every session begun with the old password (#5427)

#5427 "A password reset doesn't end the sessions already signed in with
the old password": users.sessions_since (migration 0038) is set on reset;
refresh_session_user ends a session whose login_at is earlier. An admin
resetting their own password carries on signed in.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_models.py

@@ -5,7 +5,8 @@ def test_user_model_fields():
     """User model has all required fields."""
     cols = {c.key for c in User.__table__.columns}
     assert cols == {"id", "username", "email", "password_hash", "role", "created_at", "is_active",
-                    "auth_source", "external_id", "time_zone", "notify_alerts", "notify_report"}
+                    "auth_source", "external_id", "time_zone", "notify_alerts", "notify_report",
+                    "sessions_since"}
 
 
 def test_user_role_enum():