feat(auth): server-side sessions and current password for account changes (FLAW-30, FLAW-31)

- Every login is a session (device, IP, last use); the token's jti is its ID.
  Sessions end on logout, per device from the profile, or after 30 idle days.
- Tokens older than a day are renewed via the X-Session-Token header.
- Changing password or login e-mail needs the current password; a new
  password logs out all other devices and mails the old address.
- Demo reset keeps the demo visitors' sessions.
- revoked_tokens is replaced by sessions (migration 4); everyone is logged
  out once after the upgrade.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frontend/src/features/settings/UserSettingsView.tsx

@@ -29,6 +29,7 @@ import { UserAvatar, resizeImageToDataUrl } from '../../components/UserAvatar';
 import { LegalLinks } from '../../components/LegalLinks';
 import { AboutModal } from '../../components/AboutModal';
 import { ImportCard } from './ImportCard';
+import { SessionsPanel } from './SessionsPanel';
 import { FormSheet } from '../../components/FormSheet';
 
 interface UserSettingsViewProps {
@@ -188,6 +189,7 @@ export const UserSettingsView: React.FC<UserSettingsViewProps> = ({
   const [email, setEmail] = useState(currentUser.email || '');
   const [avatarUrl, setAvatarUrl] = useState(currentUser.avatarUrl || '');
   const [newPassword, setNewPassword] = useState('');
+  const [currentPassword, setCurrentPassword] = useState('');
   const [profileMsg, setProfileMsg] = useState<{ type: 'ok' | 'err'; text: string } | null>(null);
   const [savingProfile, setSavingProfile] = useState(false);
   const [revokingSessions, setRevokingSessions] = useState(false);
@@ -253,6 +255,10 @@ export const UserSettingsView: React.FC<UserSettingsViewProps> = ({
     triggerHaptic(10);
   };
 
+  // Changing the password or the login address needs the current password (FLAW-30)
+  const needsCurrentPassword =
+    newPassword.trim() !== '' || email.trim().toLowerCase() !== (currentUser.email || '').toLowerCase();
+
   // --- Handlers: Profile ---
   const handleSaveProfile = async (e: React.FormEvent) => {
     e.preventDefault();
@@ -273,9 +279,11 @@ export const UserSettingsView: React.FC<UserSettingsViewProps> = ({
         // Not trimmed: login compares the password exactly as typed
         patch.password = newPassword;
       }
+      if (needsCurrentPassword) patch.currentPassword = currentPassword;
       const updated = await api.updateSettings(patch);
       onUserUpdated(updated);
       setNewPassword('');
+      setCurrentPassword('');
       setProfileMsg({ type: 'ok', text: 'Profil und Anmeldedaten erfolgreich gespeichert.' });
     } catch (err: any) {
       setProfileMsg({ type: 'err', text: err.message || 'Fehler beim Speichern' });
@@ -634,10 +642,27 @@ export const UserSettingsView: React.FC<UserSettingsViewProps> = ({
                     value={newPassword}
                     onChange={(e) => setNewPassword(e.target.value)}
                     placeholder="Mindestens 8 Zeichen"
+                    autoComplete="new-password"
                     className="w-full h-9 px-3 input-field"
                   />
                 </div>
 
+                {needsCurrentPassword && (
+                  <div>
+                    <label className="block text-muted font-medium mb-1">
+                      Aktuelles Passwort (zur Bestätigung)
+                    </label>
+                    <input
+                      type="password"
+                      value={currentPassword}
+                      onChange={(e) => setCurrentPassword(e.target.value)}
+                      required
+                      autoComplete="current-password"
+                      className="w-full h-9 px-3 input-field"
+                    />
+                  </div>
+                )}
+
                 <div className="pt-2 border-t border-border flex justify-end">
                   <button
                     type="submit"
@@ -654,9 +679,10 @@ export const UserSettingsView: React.FC<UserSettingsViewProps> = ({
                 <div>
                   <h3 className="text-xs font-bold text-main">Aktive Sitzungen & Sicherheit</h3>
                   <p className="text-[11px] text-muted">
-                    Sitzungen werden durch kryptografische JWTs geschützt. Bei einer Passwortänderung werden alle alten Sitzungen automatisch ungültig.
+                    Geräte, auf denen du angemeldet bist. Unbenutzte Sitzungen enden nach 30 Tagen; eine Passwortänderung meldet alle anderen Geräte ab.
                   </p>
                 </div>
+                <SessionsPanel />
                 <div className="flex flex-col sm:flex-row sm:items-center justify-between gap-3 p-3.5 rounded-card border border-border bg-canvas">
                   <div className="text-xs">
                     <p className="font-semibold text-main">Alle Sitzungen sofort beenden</p>