Add session management: track active sessions, show on profile, allow revocation

- Add user_sessions PocketBase collection (user_id, session_id, user_agent, ip, created/last_seen)
- Extend auth token format to include a per-login authSessionId (4th segment)
- Hook validates authSessionId against DB on each request; revoked sessions are cleared immediately
- Login/register create a session record capturing user-agent and IP
- Profile page shows all active sessions with current session highlighted; per-session End/Sign out buttons
- GET /api/sessions and DELETE /api/sessions/[id] endpoints for client-side revocation
- Backward compatible: legacy 3-segment tokens pass through without DB check

ui/src/app.d.ts

@@ -5,10 +5,10 @@ declare global {
 		// interface Error {}
 		interface Locals {
 			sessionId: string;
-			user: { id: string; username: string; role: string } | null;
+			user: { id: string; username: string; role: string; authSessionId: string } | null;
 		}
 		interface PageData {
-			user?: { id: string; username: string; role: string } | null;
+			user?: { id: string; username: string; role: string; authSessionId: string } | null;
 		}
 		// interface PageState {}
 		// interface Platform {}