feat(auth): add server-tracked sessions with view/revoke

JWTs were previously fully stateless -- the token alone was the credential
until its own expiry, with no way to list or kill a session server-side. Add
a UserSession table alongside every JWT issued (AppSessionIssuer), embed its
id as a "sid" claim, and check that claim against the DB on every "local"
scheme request (Program.cs OnTokenValidated) so a session can actually be
revoked before its JWT naturally expires. New /api/auth/sessions endpoints
(list, revoke one, revoke-others) plus a Sessions card on the profile page.

Fails closed on a missing "sid" claim: every JWT issued going forward has
one, so a token without it is either pre-deploy (forces one re-login for
already-signed-in users at deploy time, same additive-forward cost the
2FA/trusted-device work on this branch already paid) or forged.

JobTrackerApi/Services/TrustedDeviceService.cs

@@ -96,7 +96,8 @@ public static class TrustedDeviceService
 
     // ponytail: substring sniffing, not a real UA parser -- this only feeds a display label in
     // a security-settings list ("Chrome on Windows"), nothing security-relevant depends on it.
-    private static string? DescribeUserAgent(string? userAgent)
+    // Public: also reused by AppSessionIssuer for UserSession device labels.
+    public static string? DescribeUserAgent(string? userAgent)
     {
         if (string.IsNullOrWhiteSpace(userAgent)) return null;