Add session management: see who's signed in, revoke a session

No visibility existed into who was currently signed in or a way to
force a device out. Sessions already live as files via
session-file-store, so this reads that store directly rather than
adding a new DB table: new Settings-adjacent "Sessions" page
(admin-only, alongside Users) lists every live session with the
user's name/email/resolved role, IP, a friendly "Browser on OS"
summary parsed from the user-agent, last-active time, and expiry, with
a Revoke button per row (extra confirmation if you revoke your own
current session, since that signs you out immediately).

IP and user-agent are now captured into the session at login
(auth/router.ts) since express-session doesn't track them itself.
session-file-store's own Store type doesn't declare its list()
method, so sessionStore.ts adds a narrow local interface for it rather
than losing type safety on the rest of the store.

Verified against a real session directory seeded through the actual
session-file-store APIs (not hand-written JSON): confirmed correct
field resolution including a session whose user row was later deleted
(role resolves to null instead of crashing), correctly excluded a
mid-OIDC-login session with no completed user yet, correctly excluded
an already-expired session, and confirmed revoke actually deletes the
right session file and only that one. Confirmed the real dev
database's mtime was untouched throughout.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

server/src/routes/sessions.ts

@@ -0,0 +1,26 @@
+import { Router } from "express";
+import { requireAuth, requireRole } from "../auth/middleware.js";
+import { recordAudit } from "../services/audit.js";
+import { listSessions, destroySession } from "../services/sessionStore.js";
+import { asyncHandler } from "../utils/asyncHandler.js";
+
+export const sessionsRouter = Router();
+
+sessionsRouter.use(requireAuth, requireRole("admin"));
+
+sessionsRouter.get("/", asyncHandler(async (req, res) => {
+  const sessions = await listSessions();
+  res.json({ sessions, currentSessionId: req.sessionID });
+}));
+
+sessionsRouter.delete("/:id", asyncHandler(async (req, res) => {
+  await destroySession(req.params.id);
+  await recordAudit({
+    actor: req.currentUser!,
+    category: "session",
+    action: "revoke",
+    targetType: "session",
+    targetId: req.params.id,
+  });
+  res.status(204).end();
+}));