feat(auth): sessions expire server-side; password change and reset end other sessions (M462 #4978)

Sessions had no server-side expiry: only the web cookie's 30-day Max-Age
limited them, and a bearer token (Android) lived until revoked by hand.
GetSessionByTokenHash and ListSessionsForUser now ignore sessions idle for
30 days or older than a year, and the GC worker deletes them hourly.

A password change was a plain UPDATE, so a session opened with the old
password survived it. Now:
- self-service change signs out every other device and keeps this one;
- reset by email ends every session the account has;
- an admin reset ends the target's sessions (keeping the admin's own when
  they reset themselves).

The success copy on web and Android says the other devices were signed out.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/db/queries/sessions.sql

@@ -7,7 +7,18 @@ VALUES ($1, $2, $3, sqlc.arg(ip), sqlc.arg(ip))
 RETURNING *;
 
 -- name: GetSessionByTokenHash :one
-SELECT * FROM sessions WHERE token_hash = $1;
+-- Expired sessions are invisible here, so they fail auth the moment they
+-- lapse rather than whenever the GC sweep next runs. Two limits:
+--   idle 30 days     — a token nobody has used in a month is abandoned, and
+--                      matches the web cookie's lifetime;
+--   absolute 1 year  — even a token in daily use is re-issued yearly, so a
+--                      stolen one that is being used quietly does not live
+--                      forever.
+-- Keep in step with ListSessionsForUser and GcDeleteExpiredSessions.
+SELECT * FROM sessions
+WHERE token_hash = $1
+  AND last_seen_at > now() - interval '30 days'
+  AND created_at > now() - interval '365 days';
 
 -- name: TouchSessionLastSeen :exec
 UPDATE sessions SET last_seen_at = now(), last_ip = $2 WHERE id = $1;
@@ -15,7 +26,13 @@ UPDATE sessions SET last_seen_at = now(), last_ip = $2 WHERE id = $1;
 -- name: ListSessionsForUser :many
 -- Most-recently-active first: the row a user is most likely to act on is the
 -- one that moved last, and an unfamiliar entry at the top is the alarm.
-SELECT * FROM sessions WHERE user_id = $1 ORDER BY last_seen_at DESC;
+-- Expired rows are left out: they no longer authenticate, so listing them
+-- as active would be wrong. Same limits as GetSessionByTokenHash.
+SELECT * FROM sessions
+WHERE user_id = $1
+  AND last_seen_at > now() - interval '30 days'
+  AND created_at > now() - interval '365 days'
+ORDER BY last_seen_at DESC;
 
 -- name: DeleteSession :exec
 DELETE FROM sessions WHERE id = $1;
@@ -34,3 +51,9 @@ DELETE FROM sessions WHERE id = $1 AND user_id = $2;
 -- "Log out everywhere else." Excludes the caller's own session so the action
 -- doesn't log them out of the page they just used to invoke it.
 DELETE FROM sessions WHERE user_id = $1 AND id <> $2;
+
+-- name: DeleteSessionsForUser :execrows
+-- Every session the user has, the caller's included. A password reset uses
+-- it: whoever forgot the password is not signed in anywhere they trust, and
+-- whoever may have learned it must be signed out everywhere.
+DELETE FROM sessions WHERE user_id = $1;