Add per-device active sessions with revocation (#69)

Replaces the stateless signed-cookie session (bare user_id) with a
real server-side sessions table -- the cookie now just carries an
opaque session id, resolved against the DB on every request. Each
session records IP address (respects X-Forwarded-For), a parsed
device label, and last-seen time (throttled updates, not written on
every request).

New GET/DELETE /api/auth/sessions endpoints and an "Active sessions"
section in Profile settings let a user see every device they're
logged in from and revoke one they don't recognize -- including their
own current session, which just signs them out.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/app/models/__init__.py

@@ -15,6 +15,7 @@ from app.models.message_room_reference import MessageRoomReference
 from app.models.password_reset import PasswordReset
 from app.models.push_subscription import PushSubscription
 from app.models.room import Room
+from app.models.session import Session
 from app.models.site_invite import SiteInvite
 from app.models.smtp_settings import SmtpSettings
 from app.models.upload_settings import UploadSettings
@@ -35,6 +36,7 @@ __all__ = [
     "MessageRoomReference",
     "InviteStatus",
     "PasswordReset",
+    "Session",
     "SiteInvite",
     "SmtpSettings",
     "UploadSettings",