feat(auth): sessions expire server-side; password change and reset end other sessions (M462 #4978)

Sessions had no server-side expiry: only the web cookie's 30-day Max-Age
limited them, and a bearer token (Android) lived until revoked by hand.
GetSessionByTokenHash and ListSessionsForUser now ignore sessions idle for
30 days or older than a year, and the GC worker deletes them hourly.

A password change was a plain UPDATE, so a session opened with the old
password survived it. Now:
- self-service change signs out every other device and keeps this one;
- reset by email ends every session the account has;
- an admin reset ends the target's sessions (keeping the admin's own when
  they reset themselves).

The success copy on web and Android says the other devices were signed out.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/src/routes/settings/+page.svelte

@@ -153,7 +153,7 @@
     passwordSaving = true;
     try {
       await changePassword(passwordForm.current, passwordForm.new);
-      pushToast('Password changed.');
+      pushToast('Password changed. Your other devices have been signed out.');
       passwordForm = { current: '', new: '', confirm: '' };
     } catch (e: unknown) {
       const code = errCode(e);