feat(auth): add server-tracked sessions with view/revoke

JWTs were previously fully stateless -- the token alone was the credential
until its own expiry, with no way to list or kill a session server-side. Add
a UserSession table alongside every JWT issued (AppSessionIssuer), embed its
id as a "sid" claim, and check that claim against the DB on every "local"
scheme request (Program.cs OnTokenValidated) so a session can actually be
revoked before its JWT naturally expires. New /api/auth/sessions endpoints
(list, revoke one, revoke-others) plus a Sessions card on the profile page.

Fails closed on a missing "sid" claim: every JWT issued going forward has
one, so a token without it is either pre-deploy (forces one re-login for
already-signed-in users at deploy time, same additive-forward cost the
2FA/trusted-device work on this branch already paid) or forged.

job-tracker-ui/src/i18n/translations.ts

@@ -356,6 +356,17 @@ export const translations = {
     twoFactorTrustedDevicesRevokedAll: "All trusted devices have been signed out.",
     twoFactorRevokeAllConfirmTitle: "Sign out all trusted devices?",
     twoFactorRevokeAllConfirmBody: "You'll be asked for a 2FA code the next time you sign in on any device, including this one.",
+    sessionsSectionTitle: "Sessions",
+    sessionsEmpty: "No active sessions.",
+    sessionsUnknownDevice: "Unknown device",
+    sessionsCurrentDevice: "This device",
+    sessionsMeta: "Last active {lastSeen} · Expires {expires}",
+    sessionsRevoke: "Sign out",
+    sessionsRevoked: "Session signed out.",
+    sessionsRevokeOthers: "Sign out all other devices",
+    sessionsRevokedOthers: "All other sessions have been signed out.",
+    sessionsRevokeOthersConfirmTitle: "Sign out all other devices?",
+    sessionsRevokeOthersConfirmBody: "Every other session for your account will be signed out immediately. This device stays signed in.",
     cropDialogTitle: "Crop profile image",
     cropDialogBody: "Position and zoom your image. The saved avatar will be exported as a 512×512 square.",
     cropDialogZoom: "Zoom",
@@ -1393,6 +1404,17 @@ export const translations = {
     twoFactorTrustedDevicesRevokedAll: "Alle betrodde enheter er logget ut.",
     twoFactorRevokeAllConfirmTitle: "Logg ut alle betrodde enheter?",
     twoFactorRevokeAllConfirmBody: "Du vil bli bedt om en 2FA-kode neste gang du logger inn på en enhet, inkludert denne.",
+    sessionsSectionTitle: "Økter",
+    sessionsEmpty: "Ingen aktive økter.",
+    sessionsUnknownDevice: "Ukjent enhet",
+    sessionsCurrentDevice: "Denne enheten",
+    sessionsMeta: "Sist aktiv {lastSeen} · Utløper {expires}",
+    sessionsRevoke: "Logg ut",
+    sessionsRevoked: "Økten er logget ut.",
+    sessionsRevokeOthers: "Logg ut alle andre enheter",
+    sessionsRevokedOthers: "Alle andre økter er logget ut.",
+    sessionsRevokeOthersConfirmTitle: "Logg ut alle andre enheter?",
+    sessionsRevokeOthersConfirmBody: "Alle andre økter for kontoen din blir umiddelbart logget ut. Denne enheten forblir innlogget.",
     cropDialogTitle: "Beskjær profilbilde",
     cropDialogBody: "Plasser og zoom bildet. Det lagrede avataren eksporteres som en kvadratisk 512×512-fil.",
     cropDialogZoom: "Zoom",