feat(auth): add server-tracked sessions with view/revoke

JWTs were previously fully stateless -- the token alone was the credential
until its own expiry, with no way to list or kill a session server-side. Add
a UserSession table alongside every JWT issued (AppSessionIssuer), embed its
id as a "sid" claim, and check that claim against the DB on every "local"
scheme request (Program.cs OnTokenValidated) so a session can actually be
revoked before its JWT naturally expires. New /api/auth/sessions endpoints
(list, revoke one, revoke-others) plus a Sessions card on the profile page.

Fails closed on a missing "sid" claim: every JWT issued going forward has
one, so a token without it is either pre-deploy (forces one re-login for
already-signed-in users at deploy time, same additive-forward cost the
2FA/trusted-device work on this branch already paid) or forged.

JobTrackerApi/Services/TokenService.cs

@@ -10,7 +10,7 @@ namespace JobTrackerApi.Services;
 
 public interface ITokenService
 {
-    Task<string> CreateAccessTokenAsync(ApplicationUser user, CancellationToken cancellationToken = default);
+    Task<string> CreateAccessTokenAsync(ApplicationUser user, string? sessionId = null, CancellationToken cancellationToken = default);
 }
 
 public sealed class TokenService : ITokenService
@@ -24,7 +24,7 @@ public sealed class TokenService : ITokenService
         _users = users;
     }
 
-    public async Task<string> CreateAccessTokenAsync(ApplicationUser user, CancellationToken cancellationToken = default)
+    public async Task<string> CreateAccessTokenAsync(ApplicationUser user, string? sessionId = null, CancellationToken cancellationToken = default)
     {
         var jwtKey = (_cfg["Auth:JwtKey"] ?? "").Trim();
         if (string.IsNullOrWhiteSpace(jwtKey))
@@ -57,6 +57,9 @@ public sealed class TokenService : ITokenService
         foreach (var r in roles)
             claims.Add(new Claim(ClaimTypes.Role, r));
 
+        if (!string.IsNullOrWhiteSpace(sessionId))
+            claims.Add(new Claim("sid", sessionId));
+
         var now = DateTime.UtcNow;
 
         var token = new JwtSecurityToken(