feat(auth): add bearer-session logout, revocation and expiry cleanup

[pierrick-fonquerne]

Problem

The current local login returns an opaque bearer session, but the HTTP API exposes no logout endpoint, administrator revocation flow, password-change invalidation, or explicit cleanup policy for expired sessions. A stolen token remains usable until TTL expiry and successful logins can grow the session table indefinitely.

This is distinct from browser-cookie lifecycle tracked by #122: the existing bearer admin API also needs a complete session lifecycle.

Acceptance criteria

• An authenticated logout endpoint atomically revokes the current bearer session.
• Administrators can revoke all sessions for an account, including after password reset/change or account disablement.
• Expired and revoked sessions are cleaned up with a bounded documented mechanism.
• A configurable maximum number of active sessions per account is enforced with explicit eviction or rejection semantics.
• Login and token-bearing responses set Cache-Control: no-store.
• Revocation and security-relevant session events are audited without persisting raw tokens.
• SQLite and PostgreSQL provide equivalent behavior.
• Tests cover logout, replay after revocation, disablement, password rotation, concurrent sessions, expiry and cleanup.
• Browser sessions introduced by feat(web): add secure browser sessions, logout and CSRF protection #122 reuse compatible lifecycle services without conflating cookie and bearer authentication.