feat(api): 会话记录设备与最近活动，账户页可查看并退出任一设备，删除 passkey 或更换邮箱时退出其它设备，staff 会话空闲 30 分钟失效，吊销会话校验所属用户

internal/metrics/metrics.go

@@ -105,7 +105,10 @@ var (
 	}, []string{"door", "reason"})
 
 	// SessionsRevokedTotal counts sessions ended before expiry, by who ended
-	// them: logout (the holder) or admin (the owner revoking a user's sessions).
+	// them: logout (the holder signing out), self (the holder ending sessions
+	// from their session list), security (the other sessions ended when the
+	// holder removes a passkey or changes email) or admin (the owner revoking a
+	// user's sessions).
 	SessionsRevokedTotal = prometheus.NewCounterVec(prometheus.CounterOpts{
 		Namespace: namespace,
 		Name:      "sessions_revoked_total",