Add per-device active sessions with revocation (#69)

Replaces the stateless signed-cookie session (bare user_id) with a
real server-side sessions table -- the cookie now just carries an
opaque session id, resolved against the DB on every request. Each
session records IP address (respects X-Forwarded-For), a parsed
device label, and last-seen time (throttled updates, not written on
every request).

New GET/DELETE /api/auth/sessions endpoints and an "Active sessions"
section in Profile settings let a user see every device they're
logged in from and revoke one they don't recognize -- including their
own current session, which just signs them out.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/app/schemas/session.py

@@ -0,0 +1,20 @@
+import uuid
+from datetime import datetime
+
+from pydantic import BaseModel
+
+
+class SessionRead(BaseModel):
+    id: uuid.UUID
+    ip_address: str | None
+    # Parsed from the stored user_agent by the router (see
+    # user_agent_service.describe_user_agent) -- not a stored column, so a
+    # future improvement to the parser applies retroactively to old rows
+    # too.
+    device_label: str
+    created_at: datetime
+    last_seen_at: datetime
+    # Whether this is the session the request making this call is itself
+    # authenticated with -- lets the UI mark "this device" and treat
+    # revoking it as a self-logout rather than just another row.
+    is_current: bool