feat(auth): SA4 — server-side session revocation via per-user session epoch

Signed client-side session cookies had no server-side kill switch: logout + password
reset couldn't evict a stolen/copied cookie (valid until expiry). Add User.session_epoch
(migration 0053), record it in the cookie at every login, and reject in current_user any
cookie whose recorded epoch is behind the account's current one.
- Bump the epoch on: password reset (kills ALL sessions — a reset is a compromise response),
  password change + a new 'Log out other sessions' action (both re-stamp the CURRENT cookie
  so the caller stays signed in, evicting only the others).
- Per-account epoch map in the session so one account's revocation doesn't evict the other
  signed-in accounts in the same browser wallet.
- Missing epoch (pre-SA4 cookie) is treated as 0, so the first bump revokes grandfathered
  sessions too.
- New POST /auth/logout-others + a Settings → Account 'Active sessions' button (trilingual).

backend/app/models.py

@@ -63,6 +63,11 @@ class User(Base, TimestampMixin):
     is_suspended: Mapped[bool] = mapped_column(
         Boolean, default=False, server_default="false"
     )
+    # Server-side session revocation (SA4): a monotonic counter bumped on password reset, password
+    # change, or "log out everywhere". A signed session cookie records the epoch it was minted under;
+    # current_user rejects any cookie whose epoch is stale, so a stolen/copied cookie dies on those
+    # events (client-side signed cookies otherwise stay valid until they expire).
+    session_epoch: Mapped[int] = mapped_column(Integer, default=0, server_default="0")
     display_name: Mapped[str | None] = mapped_column(String(255))
     avatar_url: Mapped[str | None] = mapped_column(String(1024))
     role: Mapped[str] = mapped_column(String(16), default="user", server_default="user")