feat(api): 会话记录设备与最近活动，账户页可查看并退出任一设备，删除 passkey 或更换邮箱时退出其它设备，staff 会话空闲 30 分钟失效，吊销会话校验所属用户

internal/api/handlers_users.go

@@ -387,7 +387,12 @@ func (a *API) handleRevokeUserSession(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if err := a.Repo.RevokeSession(r.Context(), tokenHash); err != nil {
+	if err := a.Repo.RevokeUserSession(r.Context(), id, tokenHash); err != nil {
+		if errors.Is(err, ErrNotFound) {
+			writeError(w, r, newError(http.StatusNotFound, "session_not_found",
+				"that session has already ended or does not belong to this user"))
+			return
+		}
 		writeError(w, r, err)
 		return
 	}