Add session management: see who's signed in, revoke a session

No visibility existed into who was currently signed in or a way to
force a device out. Sessions already live as files via
session-file-store, so this reads that store directly rather than
adding a new DB table: new Settings-adjacent "Sessions" page
(admin-only, alongside Users) lists every live session with the
user's name/email/resolved role, IP, a friendly "Browser on OS"
summary parsed from the user-agent, last-active time, and expiry, with
a Revoke button per row (extra confirmation if you revoke your own
current session, since that signs you out immediately).

IP and user-agent are now captured into the session at login
(auth/router.ts) since express-session doesn't track them itself.
session-file-store's own Store type doesn't declare its list()
method, so sessionStore.ts adds a narrow local interface for it rather
than losing type safety on the rest of the store.

Verified against a real session directory seeded through the actual
session-file-store APIs (not hand-written JSON): confirmed correct
field resolution including a session whose user row was later deleted
(role resolves to null instead of crashing), correctly excluded a
mid-OIDC-login session with no completed user yet, correctly excluded
an already-expired session, and confirmed revoke actually deletes the
right session file and only that one. Confirmed the real dev
database's mtime was untouched throughout.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

web/src/App.tsx

@@ -4,6 +4,7 @@ import { api, type CurrentUser, type UserRole, UnauthorizedError } from "./api/c
 import Login from "./pages/Login";
 import Dashboard from "./pages/Dashboard";
 import Users from "./pages/Users";
+import Sessions from "./pages/Sessions";
 import AuditLog from "./pages/AuditLog";
 import DiagLog from "./pages/DiagLog";
 import Secrets from "./pages/Secrets";
@@ -99,6 +100,14 @@ export default function App() {
             </RequireRole>
           }
         />
+        <Route
+          path="/sessions"
+          element={
+            <RequireRole user={user} minRole="admin">
+              <Sessions />
+            </RequireRole>
+          }
+        />
         <Route
           path="/audit-log"
           element={