feat(auth): add server-tracked sessions with view/revoke

JWTs were previously fully stateless -- the token alone was the credential
until its own expiry, with no way to list or kill a session server-side. Add
a UserSession table alongside every JWT issued (AppSessionIssuer), embed its
id as a "sid" claim, and check that claim against the DB on every "local"
scheme request (Program.cs OnTokenValidated) so a session can actually be
revoked before its JWT naturally expires. New /api/auth/sessions endpoints
(list, revoke one, revoke-others) plus a Sessions card on the profile page.

Fails closed on a missing "sid" claim: every JWT issued going forward has
one, so a token without it is either pre-deploy (forces one re-login for
already-signed-in users at deploy time, same additive-forward cost the
2FA/trusted-device work on this branch already paid) or forged.

Data/JobTrackerContext.cs

@@ -30,6 +30,7 @@ namespace JobTrackerApi.Data
     public DbSet<TailoredCvDraft> TailoredCvDrafts => Set<TailoredCvDraft>();
     public DbSet<TwoFactorRecoveryCode> TwoFactorRecoveryCodes => Set<TwoFactorRecoveryCode>();
     public DbSet<TrustedDevice> TrustedDevices => Set<TrustedDevice>();
+    public DbSet<UserSession> UserSessions => Set<UserSession>();
 
     protected override void OnModelCreating(ModelBuilder modelBuilder)
     {
@@ -164,6 +165,18 @@ namespace JobTrackerApi.Data
 
         modelBuilder.Entity<TrustedDevice>()
             .HasIndex(x => x.TokenHash);
+
+        // No FK to AspNetUsers, same convention as TrustedDevice/TwoFactorRecoveryCode above: the
+        // OnTokenValidated auth check reads this table before CurrentUserId is meaningfully set
+        // for the request being validated, via IgnoreQueryFilters().
+        modelBuilder.Entity<UserSession>()
+            .HasKey(x => x.Id);
+
+        modelBuilder.Entity<UserSession>()
+            .HasQueryFilter(x => CurrentUserId != null && x.UserId == CurrentUserId);
+
+        modelBuilder.Entity<UserSession>()
+            .HasIndex(x => x.UserId);
     }
 }
 }