feat(auth): SA4 — server-side session revocation via per-user session epoch

Signed client-side session cookies had no server-side kill switch: logout + password
reset couldn't evict a stolen/copied cookie (valid until expiry). Add User.session_epoch
(migration 0053), record it in the cookie at every login, and reject in current_user any
cookie whose recorded epoch is behind the account's current one.
- Bump the epoch on: password reset (kills ALL sessions — a reset is a compromise response),
  password change + a new 'Log out other sessions' action (both re-stamp the CURRENT cookie
  so the caller stays signed in, evicting only the others).
- Per-account epoch map in the session so one account's revocation doesn't evict the other
  signed-in accounts in the same browser wallet.
- Missing epoch (pre-SA4 cookie) is treated as 0, so the first bump revokes grandfathered
  sessions too.
- New POST /auth/logout-others + a Settings → Account 'Active sessions' button (trilingual).

frontend/src/components/SettingsPanel.tsx

@@ -308,11 +308,36 @@ function AccessRow({
 function SignInMethods({ me }: { me: Me }) {
   const { t } = useTranslation();
   const qc = useQueryClient();
+  const confirm = useConfirm();
   const [open, setOpen] = useState(false);
   const [current, setCurrent] = useState("");
   const [next, setNext] = useState("");
   const [err, setErr] = useState<string | null>(null);
   const [busy, setBusy] = useState(false);
+  const [sessBusy, setSessBusy] = useState(false);
+
+  // SA4: sign every OTHER session for this account out (this one stays). For a shared/left-behind
+  // device or a suspected compromise.
+  const logoutOthers = async () => {
+    if (
+      !(await confirm({
+        title: t("settings.account.sessions.confirmTitle"),
+        message: t("settings.account.sessions.confirmBody"),
+        confirmLabel: t("settings.account.sessions.action"),
+        danger: true,
+      }))
+    )
+      return;
+    setSessBusy(true);
+    try {
+      await api.logoutOthers();
+      notify({ level: "success", message: t("settings.account.sessions.done") });
+    } catch {
+      notify({ level: "error", message: t("settings.account.sessions.failed") });
+    } finally {
+      setSessBusy(false);
+    }
+  };
 
   const submit = async (e: React.FormEvent) => {
     e.preventDefault();
@@ -422,6 +447,24 @@ function SignInMethods({ me }: { me: Me }) {
           </form>
         )}
       </div>
+
+      <div className="border-t border-border mt-1 pt-1">
+        <div className="flex items-start justify-between gap-3 py-2">
+          <div className="min-w-0">
+            <div className="text-sm font-medium">{t("settings.account.sessions.title")}</div>
+            <p className="text-xs text-muted leading-relaxed mt-0.5">
+              {t("settings.account.sessions.hint")}
+            </p>
+          </div>
+          <button
+            onClick={logoutOthers}
+            disabled={sessBusy}
+            className="shrink-0 glass-card glass-hover px-3 py-1.5 rounded-xl text-sm transition disabled:opacity-40"
+          >
+            {t("settings.account.sessions.action")}
+          </button>
+        </div>
+      </div>
     </Section>
   );
 }

frontend/src/i18n/locales/de/settings.json

@@ -97,6 +97,15 @@
       "saving": "Speichern…",
       "saved": "Passwort für {{email}} aktualisiert.",
       "failed": "Das Passwort konnte nicht aktualisiert werden."
+    },
+    "sessions": {
+      "title": "Aktive Sitzungen",
+      "hint": "Diese Kontoanmeldung überall sonst abmelden — praktisch, wenn du auf einem geteilten oder verlorenen Gerät angemeldet geblieben bist. Hier bleibst du angemeldet.",
+      "action": "Andere Sitzungen abmelden",
+      "confirmTitle": "Andere Sitzungen abmelden?",
+      "confirmBody": "Damit wirst du in allen anderen Browsern und auf allen anderen Geräten abgemeldet. Hier bleibst du angemeldet.",
+      "done": "Von allen anderen Sitzungen abgemeldet.",
+      "failed": "Andere Sitzungen konnten nicht abgemeldet werden. Bitte versuche es erneut."
     }
   },
   "demo": {

frontend/src/i18n/locales/en/settings.json

@@ -97,6 +97,15 @@
       "saving": "Saving…",
       "saved": "Password updated for {{email}}.",
       "failed": "Couldn't update the password."
+    },
+    "sessions": {
+      "title": "Active sessions",
+      "hint": "Sign this account out everywhere else — handy if you left it signed in on a shared or lost device. You stay signed in here.",
+      "action": "Log out other sessions",
+      "confirmTitle": "Log out other sessions?",
+      "confirmBody": "This signs you out of every other browser and device. You'll stay signed in here.",
+      "done": "Signed out of all other sessions.",
+      "failed": "Couldn't sign out other sessions. Please try again."
     }
   },
   "demo": {

frontend/src/i18n/locales/hu/settings.json

@@ -97,6 +97,15 @@
       "saving": "Mentés…",
       "saved": "Jelszó frissítve ehhez: {{email}}.",
       "failed": "Nem sikerült frissíteni a jelszót."
+    },
+    "sessions": {
+      "title": "Aktív munkamenetek",
+      "hint": "Jelentkeztesd ki ezt a fiókot minden más helyen — hasznos, ha megosztott vagy elveszett eszközön maradt bejelentkezve. Itt bejelentkezve maradsz.",
+      "action": "Kijelentkezés máshonnan",
+      "confirmTitle": "Kijelentkezés a többi munkamenetből?",
+      "confirmBody": "Ez kijelentkeztet minden más böngészőből és eszközről. Itt bejelentkezve maradsz.",
+      "done": "Kijelentkeztetve minden más munkamenetből.",
+      "failed": "Nem sikerült kijelentkeztetni a többi munkamenetet. Próbáld újra."
     }
   },
   "demo": {

frontend/src/lib/api.ts

@@ -1394,6 +1394,8 @@ export const api = {
   // Confirm an email-verification token the SPA read from the URL fragment (SB3).
   verifyEmail: (token: string): Promise<{ ok: boolean }> =>
     req("/auth/verify", { method: "POST", body: JSON.stringify({ token }) }, { quiet: true }),
+  // SA4: sign every OTHER session for this account out (keeps the current one).
+  logoutOthers: (): Promise<{ ok: boolean }> => req("/auth/logout-others", { method: "POST" }),
   // Set or change the signed-in account's password (errors shown inline via quiet).
   setPassword: (password: string, currentPassword?: string): Promise<{ ok: boolean }> =>
     req(