fix(security): stream tickets instead of session tokens in URLs (FLAW-22)

WebSocket and EventSource put the 30-day session token into the URL,
where proxies log it. The app now gets a one-time ticket right before
connecting (POST /auth/stream-ticket, 60 s, bound to the token version);
?token= is no longer accepted for streams, non-browser clients may use
the Authorization header.

With BASE_URL set, CORS allows only that origin and WebSocket upgrades
only it or the requested host; credentials are off (no cookies exist).
Logout, ending all sessions, a new password and deactivation close all
live streams of the account; clients with a valid session reconnect
with a fresh ticket.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/handlers_auth.go

@@ -400,6 +400,8 @@ func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request) {
 			_ = s.store.RevokeToken(tokenStr, userID, exp)
 		}
 	}
+	// Streams are not tied to one session; other devices reconnect with a new ticket on their own
+	s.wsHub.DisconnectUser(userID)
 	writeJSON(w, http.StatusOK, map[string]bool{"success": true})
 }
 
@@ -409,6 +411,7 @@ func (s *Server) handleRevokeAllSessions(w http.ResponseWriter, r *http.Request)
 		writeError(w, http.StatusInternalServerError, "Sitzungen konnten nicht beendet werden")
 		return
 	}
+	s.wsHub.DisconnectUser(userID)
 	writeJSON(w, http.StatusOK, map[string]bool{"success": true})
 }
 
@@ -454,6 +457,7 @@ func (s *Server) handleUpdateUserSettings(w http.ResponseWriter, r *http.Request
 			return
 		}
 		_ = s.store.UpdateUserPassword(userID, hash)
+		s.wsHub.DisconnectUser(userID)
 	}
 	u, err := s.store.UpdateUserFull(
 		userID,