feat(auth): server-side sessions and current password for account changes (FLAW-30, FLAW-31)

- Every login is a session (device, IP, last use); the token's jti is its ID.
  Sessions end on logout, per device from the profile, or after 30 idle days.
- Tokens older than a day are renewed via the X-Session-Token header.
- Changing password or login e-mail needs the current password; a new
  password logs out all other devices and mails the old address.
- Demo reset keeps the demo visitors' sessions.
- revoked_tokens is replaced by sessions (migration 4); everyone is logged
  out once after the upgrade.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/server_test.go

@@ -47,7 +47,7 @@ func setupTestServer(t *testing.T) (*Server, *storage.Store, string) {
 	hub := ws.NewHub()
 	srv := NewServer(cfg, store, hub, nil)
 
-	token, err := auth.GenerateToken(cfg.JWTSecret, user.ID, user.Email, user.DisplayName, user.TokenVersion)
+	token, err := auth.GenerateToken(cfg.JWTSecret, user.ID, user.Email, user.DisplayName, user.TokenVersion, testSession(t, store, user.ID))
 	if err != nil {
 		t.Fatalf("failed to generate token: %v", err)
 	}
@@ -222,7 +222,7 @@ func TestQuickDumpToTriageAndDirectTargets(t *testing.T) {
 	router := srv.Router()
 
 	// Verify stale token from non-existent user is rejected (401)
-	staleToken, _ := auth.GenerateToken("test-jwt-secret-key", "usr_non_existent", "old@mindsift.local", "Old", 1)
+	staleToken, _ := auth.GenerateToken("test-jwt-secret-key", "usr_non_existent", "old@mindsift.local", "Old", 1, "")
 	req := httptest.NewRequest(http.MethodGet, "/api/v1/auth/me", nil)
 	req.Header.Set("Authorization", "Bearer "+staleToken)
 	rec := httptest.NewRecorder()
@@ -553,11 +553,11 @@ func TestSpaceMembersDirectInvitationAPI(t *testing.T) {
 		t.Fatalf("failed to get normal user: %v", err)
 	}
 
-	adminToken, err := auth.GenerateToken(cfg.JWTSecret, adminUser.ID, adminUser.Email, adminUser.DisplayName, adminUser.TokenVersion)
+	adminToken, err := auth.GenerateToken(cfg.JWTSecret, adminUser.ID, adminUser.Email, adminUser.DisplayName, adminUser.TokenVersion, testSession(t, store, adminUser.ID))
 	if err != nil {
 		t.Fatalf("failed to generate token: %v", err)
 	}
-	userToken, err := auth.GenerateToken(cfg.JWTSecret, normalUser.ID, normalUser.Email, normalUser.DisplayName, normalUser.TokenVersion)
+	userToken, err := auth.GenerateToken(cfg.JWTSecret, normalUser.ID, normalUser.Email, normalUser.DisplayName, normalUser.TokenVersion, testSession(t, store, normalUser.ID))
 	if err != nil {
 		t.Fatalf("failed to generate token: %v", err)
 	}
@@ -670,7 +670,7 @@ func TestWorkspaceTagsAPI(t *testing.T) {
 	router := srv.Router()
 
 	user, _ := store.CreateUser("api_tag_user@example.com", "hash", "API Tag User", "member")
-	token, _ := auth.GenerateToken(srv.cfg.JWTSecret, user.ID, user.Email, user.DisplayName, user.TokenVersion)
+	token, _ := auth.GenerateToken(srv.cfg.JWTSecret, user.ID, user.Email, user.DisplayName, user.TokenVersion, testSession(t, store, user.ID))
 
 	// Create document with hashtags
 	blocks := []domain.DocumentBlock{
@@ -920,7 +920,7 @@ func TestDecoupledFolderSharingAPI(t *testing.T) {
 	if err != nil {
 		t.Fatalf("failed to create user B: %v", err)
 	}
-	tokenB, err := auth.GenerateToken(srv.cfg.JWTSecret, userB.ID, userB.Email, userB.DisplayName, userB.TokenVersion)
+	tokenB, err := auth.GenerateToken(srv.cfg.JWTSecret, userB.ID, userB.Email, userB.DisplayName, userB.TokenVersion, testSession(t, store, userB.ID))
 	if err != nil {
 		t.Fatalf("failed to generate token B: %v", err)
 	}
@@ -1238,10 +1238,10 @@ func TestDocumentSharingStrictlyReadOnly(t *testing.T) {
 	router := srv.Router()
 
 	userA, _ := store.CreateUser("user_a_ro@example.com", "hash", "User A", "member")
-	tokenA, _ := auth.GenerateToken(srv.cfg.JWTSecret, userA.ID, userA.Email, userA.DisplayName, userA.TokenVersion)
+	tokenA, _ := auth.GenerateToken(srv.cfg.JWTSecret, userA.ID, userA.Email, userA.DisplayName, userA.TokenVersion, testSession(t, store, userA.ID))
 
 	userB, _ := store.CreateUser("user_b_ro@example.com", "hash", "User B", "member")
-	tokenB, _ := auth.GenerateToken(srv.cfg.JWTSecret, userB.ID, userB.Email, userB.DisplayName, userB.TokenVersion)
+	tokenB, _ := auth.GenerateToken(srv.cfg.JWTSecret, userB.ID, userB.Email, userB.DisplayName, userB.TokenVersion, testSession(t, store, userB.ID))
 
 	// Create document owned by User A
 	blocks := []domain.DocumentBlock{
@@ -1525,3 +1525,13 @@ func TestPasswordResetFlow(t *testing.T) {
 		t.Errorf("token must work only once, got %d", code)
 	}
 }
+
+// testSession starts a server-side session, as a login would, for tokens made directly in tests.
+func testSession(t *testing.T, store *storage.Store, userID string) string {
+	t.Helper()
+	sid, err := store.CreateSession(userID, "go-test", "192.0.2.1")
+	if err != nil {
+		t.Fatalf("CreateSession: %v", err)
+	}
+	return sid
+}