feat(auth): add server-tracked sessions with view/revoke

JWTs were previously fully stateless -- the token alone was the credential
until its own expiry, with no way to list or kill a session server-side. Add
a UserSession table alongside every JWT issued (AppSessionIssuer), embed its
id as a "sid" claim, and check that claim against the DB on every "local"
scheme request (Program.cs OnTokenValidated) so a session can actually be
revoked before its JWT naturally expires. New /api/auth/sessions endpoints
(list, revoke one, revoke-others) plus a Sessions card on the profile page.

Fails closed on a missing "sid" claim: every JWT issued going forward has
one, so a token without it is either pre-deploy (forces one re-login for
already-signed-in users at deploy time, same additive-forward cost the
2FA/trusted-device work on this branch already paid) or forged.

job-tracker-ui/src/views/ProfilePage.tsx

@@ -12,6 +12,7 @@ import GoogleAuthCard from "../components/GoogleAuthCard";
 import MicrosoftAuthCard from "../components/MicrosoftAuthCard";
 import AuthStatusCard from "../components/AuthStatusCard";
 import TwoFactorSettingsCard from "../components/TwoFactorSettingsCard";
+import SessionsSettingsCard from "../components/SessionsSettingsCard";
 import EmailProviderConnections from "../components/EmailProviderConnections";
 import CropImageDialog from "../components/CropImageDialog";
 import { useToast } from "../toast";
@@ -1351,6 +1352,7 @@ export default function ProfilePage() {
       </Box>
 
       {isLocal ? <TwoFactorSettingsCard /> : null}
+      {isLocal ? <SessionsSettingsCard /> : null}
     </Paper>
   );
 }