feat(auth): add active sessions management

- store refresh session metadata in redis (ip/user-agent/created_at)

- add auth APIs: list sessions, revoke one, revoke all

- add web privacy UI for active sessions

web/src/api/auth.ts

@@ -1,5 +1,5 @@
 import { http } from "./http";
-import type { AuthUser, TokenPair } from "../chat/types";
+import type { AuthSession, AuthUser, TokenPair } from "../chat/types";
 
 export async function registerRequest(email: string, name: string, username: string, password: string): Promise<void> {
   await http.post("/auth/register", { email, name, username, password });
@@ -19,3 +19,16 @@ export async function meRequest(): Promise<AuthUser> {
   const { data } = await http.get<AuthUser>("/auth/me");
   return data;
 }
+
+export async function listSessions(): Promise<AuthSession[]> {
+  const { data } = await http.get<AuthSession[]>("/auth/sessions");
+  return data;
+}
+
+export async function revokeSession(jti: string): Promise<void> {
+  await http.delete(`/auth/sessions/${jti}`);
+}
+
+export async function revokeAllSessions(): Promise<void> {
+  await http.delete("/auth/sessions");
+}