Add session management: track active sessions, show on profile, allow revocation

- Add user_sessions PocketBase collection (user_id, session_id, user_agent, ip, created/last_seen)
- Extend auth token format to include a per-login authSessionId (4th segment)
- Hook validates authSessionId against DB on each request; revoked sessions are cleared immediately
- Login/register create a session record capturing user-agent and IP
- Profile page shows all active sessions with current session highlighted; per-session End/Sign out buttons
- GET /api/sessions and DELETE /api/sessions/[id] endpoints for client-side revocation
- Backward compatible: legacy 3-segment tokens pass through without DB check

ui/src/hooks.server.ts

@@ -2,6 +2,7 @@ import type { Handle } from '@sveltejs/kit';
 import { randomBytes, createHmac } from 'node:crypto';
 import { env } from '$env/dynamic/private';
 import { log } from '$lib/server/logger';
+import { createUserSession, touchUserSession, isSessionRevoked } from '$lib/server/pocketbase';
 
 const SESSION_COOKIE = 'libnovel_session';
 const AUTH_COOKIE = 'libnovel_auth';
@@ -40,27 +41,30 @@ export function verifyToken(token: string): string | null {
 
 /**
  * Create a signed auth token for a user.
- * Payload format: "<userId>:<username>:<role>"
+ * Payload format: "<userId>:<username>:<role>:<authSessionId>"
+ * authSessionId uniquely identifies this login session (for revocation).
  */
-export function createAuthToken(userId: string, username: string, role: string): string {
-	return signToken(`${userId}:${username}:${role}`);
+export function createAuthToken(userId: string, username: string, role: string, authSessionId: string): string {
+	return signToken(`${userId}:${username}:${role}:${authSessionId}`);
 }
 
 /**
  * Parse a verified auth token into user data. Returns null if invalid.
+ * Supports both old format (3 segments) and new format (4 segments).
  */
-export function parseAuthToken(token: string): { id: string; username: string; role: string } | null {
+export function parseAuthToken(token: string): { id: string; username: string; role: string; authSessionId: string } | null {
 	const payload = verifyToken(token);
 	if (!payload) return null;
-	const firstColon = payload.indexOf(':');
-	if (firstColon < 0) return null;
-	const secondColon = payload.indexOf(':', firstColon + 1);
-	if (secondColon < 0) return null;
-	const id = payload.slice(0, firstColon);
-	const username = payload.slice(firstColon + 1, secondColon);
-	const role = payload.slice(secondColon + 1);
+	const parts = payload.split(':');
+	// New format: userId:username:role:authSessionId (4 parts)
+	// Old format: userId:username:role (3 parts — legacy tokens before session tracking)
+	if (parts.length < 3) return null;
+	const id = parts[0];
+	const username = parts[1];
+	const role = parts[2];
+	const authSessionId = parts[3] ?? ''; // empty string for legacy tokens
 	if (!id || !username) return null;
-	return { id, username, role };
+	return { id, username, role, authSessionId };
 }
 
 // ─── Hook ─────────────────────────────────────────────────────────────────────
@@ -85,8 +89,32 @@ export const handle: Handle = async ({ event, resolve }) => {
 		const user = parseAuthToken(authToken);
 		if (!user) {
 			log.warn('auth', 'auth cookie present but failed to parse (malformed or tampered)');
+			event.locals.user = null;
+		} else {
+			// Validate session against DB (only for new-format tokens with authSessionId)
+			let sessionValid = true;
+			if (user.authSessionId) {
+				try {
+					const revoked = await isSessionRevoked(user.authSessionId);
+					if (revoked) {
+						log.info('auth', 'auth cookie references revoked session', {
+							userId: user.id,
+							authSessionId: user.authSessionId
+						});
+						sessionValid = false;
+						// Clear the invalid cookie
+						event.cookies.delete(AUTH_COOKIE, { path: '/' });
+					} else {
+						// Best-effort: update last_seen in the background
+						touchUserSession(user.authSessionId).catch(() => {});
+					}
+				} catch (err) {
+					// DB error — fail open to avoid locking everyone out
+					log.warn('auth', 'session check failed (fail open)', { err: String(err) });
+				}
+			}
+			event.locals.user = sessionValid ? user : null;
 		}
-		event.locals.user = user;
 	} else {
 		event.locals.user = null;
 	}