feat(auth): add owner-tier passkey-unbind remediation endpoint

Add DELETE /api/v1/users/{id}/passkeys (owner-only) to unbind every passkey a
target account holds — the authenticator remediation that stops a passkey planted
or retained via a transiently-hijacked session from surviving as a standing login
foothold. It wires the previously-uncalled DeleteAllPasskeyCredentialsForUser and
is deliberately not a lockout: the account re-enters via the email-OTP door
(players) or op-login's in-game approval (staff), then re-enrolls. Documented in
the OpenAPI, so the served/documented parity gate covers it.

Remove RevokeUserSessionsExcept: a change-password-era orphan with no callers
since the passwordless migration. Its keep-one ("log out my other devices")
semantics is inherently self-service, and no such slice is on the roadmap; the
admin remediation path already uses RevokeAllUserSessions.

internal/api/repo.go

@@ -440,9 +440,6 @@ type Repo interface {
 	// RevokeSession marks a session revoked (logout). It is idempotent: revoking an
 	// absent or already-revoked session is not an error.
 	RevokeSession(ctx context.Context, tokenHash string) error
-	// RevokeUserSessionsExcept revokes every live session of a user except the one
-	// whose hash is keepTokenHash. Used to log out other devices on a security event.
-	RevokeUserSessionsExcept(ctx context.Context, userID, keepTokenHash string) error
 
 	// ConsumeSetupToken atomically marks a one-time setup token consumed and returns
 	// its user_id, or ErrNotFound when the token is absent, already consumed, or