Add per-device active sessions with revocation (#69)

Replaces the stateless signed-cookie session (bare user_id) with a
real server-side sessions table -- the cookie now just carries an
opaque session id, resolved against the DB on every request. Each
session records IP address (respects X-Forwarded-For), a parsed
device label, and last-seen time (throttled updates, not written on
every request).

New GET/DELETE /api/auth/sessions endpoints and an "Active sessions"
section in Profile settings let a user see every device they're
logged in from and revoke one they don't recognize -- including their
own current session, which just signs them out.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/app/routers/signup.py

@@ -5,6 +5,7 @@ from app.database import get_db
 from app.schemas.site_invite import SignupComplete, SignupValidateRead
 from app.schemas.user import UserRead
 from app.services.auth_service import DuplicateUserError
+from app.services.session_service import start_session
 from app.services.site_invite_service import (
     SiteInviteInvalidError,
     complete_signup,
@@ -39,5 +40,5 @@ async def complete_signup_endpoint(
     except DuplicateUserError:
         raise HTTPException(status_code=409, detail="That username or email is already taken")
 
-    request.session["user_id"] = str(user.id)
+    await start_session(request, db, user.id)
     return user