The forge owner revokes any account's tokens and sessions from a page, and a person sees their own sessions #750

Follows #666, which added GET/DELETE /api/v1/users/:username/tokens[/:id] (owner of the account, or the forge's owner). There is no page for it yet, and web sessions are not listed anywhere.

Acceptance:

• [ ] Settings → Access tokens also lists the account's signed-in browsers (created, last seen) with Sign out for each
• [ ] the forge owner's account page for any person lists their tokens and sessions with Revoke, through revokeAccountToken
• [ ] tests: a revoked session's next request is signed out; a non-owner gets not_found