feat(auth): server-side sessions and current password for account changes (FLAW-30, FLAW-31)

- Every login is a session (device, IP, last use); the token's jti is its ID.
  Sessions end on logout, per device from the profile, or after 30 idle days.
- Tokens older than a day are renewed via the X-Session-Token header.
- Changing password or login e-mail needs the current password; a new
  password logs out all other devices and mails the old address.
- Demo reset keeps the demo visitors' sessions.
- revoked_tokens is replaced by sessions (migration 4); everyone is logged
  out once after the upgrade.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/auth/auth.go

@@ -58,13 +58,16 @@ func CheckPassword(password, hash string) bool {
 	return err == nil
 }
 
-func GenerateToken(secret, userID, email, displayName string, tokenVersion int) (string, error) {
+// TokenLifetime is the absolute lifetime of a session token; while the session is used the token is
+// renewed long before (see api.authMiddleware), idle sessions end after 30 days on the server side.
+const TokenLifetime = 30 * 24 * time.Hour
+
+// GenerateToken signs a session token; sessionID (the JWT ID) names the server-side session row.
+func GenerateToken(secret, userID, email, displayName string, tokenVersion int, sessionID string) (string, error) {
 	if tokenVersion <= 0 {
 		tokenVersion = 1
 	}
-	b := make([]byte, 16)
-	_, _ = rand.Read(b)
-	jti := hex.EncodeToString(b)
+	jti := sessionID
 
 	now := time.Now()
 	claims := &Claims{
@@ -74,7 +77,7 @@ func GenerateToken(secret, userID, email, displayName string, tokenVersion int)
 		TokenVersion: tokenVersion,
 		RegisteredClaims: jwt.RegisteredClaims{
 			ID:        jti,
-			ExpiresAt: jwt.NewNumericDate(now.Add(30 * 24 * time.Hour)),
+			ExpiresAt: jwt.NewNumericDate(now.Add(TokenLifetime)),
 			IssuedAt:  jwt.NewNumericDate(now),
 			Issuer:    "mindsift",
 		},