Sign-ins: see and end your browsers; the owner ends any person's tokens and browsers #838

Closes #750

• Settings → Access tokens now lists the account's signed-in browsers: when each signed in, when it was last seen, and which one is this browser. Each has a Sign out button.
• The owner's Accounts list links each person to a page (/settings/accounts/:username) showing their access tokens and browsers, with Revoke and Sign out. It is not available for another admin, an agent, or yourself: your own sign-ins are in your settings.
• API, for agent parity: GET /api/v1/users/:username/signins, DELETE /api/v1/users/:username/tokens/:id, DELETE /api/v1/users/:username/sessions/:id. They take a browser session, a password, or an admin-scope token.
• Everyone else gets not_found. When the owner ends someone else's sign-in, an account.signed_out event records it.
• Migration 57: a session gets an id (not its secret) and a last-seen time. The last-seen time is written at most once a minute per browser.

Tests: test/signins.test.ts, admitted to the gate. A browser that was signed out is signed out on its next request. A revoked token stops working at once. A non-owner gets not_found by every route, and the victim's credentials still work afterwards. A non-admin token is refused. The owner's acts are audited.

🤖 Generated with Claude Code