Signing a browser out ends the live streams it opened #860

Follow-up to #838 (#750), from its review.

Signing a browser out, by the person in Settings or by the forge's owner on the person's page or through the API, now also ends the live event streams that browser opened. Until now they ran until they closed by themselves. The account's other browsers keep theirs.

• Auth carries which browser asked (sessionId, read from the same session row sessionUser already reads, so no extra query).
• Streams are held by account and, for a browser, by that browser too (src/http/caller.ts).
• endAccountSession appends session.ended with the browser's public id (never its secret), and the listener closes that browser's streams.

Test: test/signins.test.ts. One of two browsers is signed out: its stream ends and the other's stays open. The test fails on main.

🤖 Generated with Claude Code