fix(app): harden account and workflow state

JobTrackerApi/Controllers/UsersController.cs

@@ -179,6 +179,13 @@ public sealed class UsersController : ControllerBase
             if (!removeRoles.Succeeded) return IdentityFailure(removeRoles);
         }
 
+        // Role claims are embedded in issued JWTs. Without revoking the target user's live
+        // sessions, a removed Admin role would remain effective until those tokens expired.
+        // The application DI path always supplies the context; the null branch only supports
+        // isolated controller construction in older tests.
+        if (_db is not null && (toAdd.Count > 0 || toRemove.Count > 0))
+            await SessionRevocation.RevokeAllAsync(_db, u.Id, trustedDeviceHashToKeep: null, cancellationToken);
+
         return NoContent();
     }