Add per-device active sessions with revocation (#69)

Replaces the stateless signed-cookie session (bare user_id) with a
real server-side sessions table -- the cookie now just carries an
opaque session id, resolved against the DB on every request. Each
session records IP address (respects X-Forwarded-For), a parsed
device label, and last-seen time (throttled updates, not written on
every request).

New GET/DELETE /api/auth/sessions endpoints and an "Active sessions"
section in Profile settings let a user see every device they're
logged in from and revoke one they don't recognize -- including their
own current session, which just signs them out.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

frontend/src/components/Modal.css

@@ -429,6 +429,25 @@
   color: var(--ds-muted);
 }
 
+.modal-list-row-action {
+  flex: none;
+  background: transparent;
+  border: none;
+  color: var(--ds-danger);
+  font-size: 0.76rem;
+  cursor: pointer;
+  padding: 4px 6px;
+}
+
+.modal-list-row-action:hover:not(:disabled) {
+  text-decoration: underline;
+}
+
+.modal-list-row-action:disabled {
+  cursor: not-allowed;
+  opacity: 0.6;
+}
+
 .profile-modal-avatar-row {
   display: flex;
   align-items: center;