chore: release server-v1.0.56

会话/设备管理后端：user_sessions 会话表、JWT 加 sid 校验、按平台类限并发登录、
登录失败锁定、修复禁用账号仍可凭 refresh 续期漏洞、/auth/ping、/auth/logout、
GET /sessions、DELETE /sessions/:id（管理员强制下线）。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/internal/model/user.go

@@ -1,13 +1,16 @@
 package model
 
+import "time"
+
 type User struct {
 	Base
-	ShopID       uint64 `gorm:"not null;index;uniqueIndex:uk_shop_username" json:"shop_id"`
-	Username     string `gorm:"size:50;uniqueIndex:uk_shop_username" json:"username"`
-	PasswordHash string `gorm:"size:255" json:"-"`
-	RealName     string `gorm:"size:50" json:"real_name"`
-	Phone        string `gorm:"size:30" json:"phone"`
-	Role         string `gorm:"type:enum('admin','operator','readonly','superadmin');default:'operator'" json:"role"`
-	IsActive     bool   `gorm:"default:true" json:"is_active"`
-	CustomFields JSON   `gorm:"type:json" json:"custom_fields,omitempty"`
+	ShopID       uint64     `gorm:"not null;index;uniqueIndex:uk_shop_username" json:"shop_id"`
+	Username     string     `gorm:"size:50;uniqueIndex:uk_shop_username" json:"username"`
+	PasswordHash string     `gorm:"size:255" json:"-"`
+	RealName     string     `gorm:"size:50" json:"real_name"`
+	Phone        string     `gorm:"size:30" json:"phone"`
+	Role         string     `gorm:"type:enum('admin','operator','readonly','superadmin');default:'operator'" json:"role"`
+	IsActive     bool       `gorm:"default:true" json:"is_active"`
+	LastLoginAt  *time.Time `json:"last_login_at,omitempty"`
+	CustomFields JSON       `gorm:"type:json" json:"custom_fields,omitempty"`
 }

backend/internal/model/user_session.go

@@ -0,0 +1,39 @@
+package model
+
+import "time"
+
+// UserSession 服务端登录会话。JWT 的 sid claim 指向此表一行，
+// 用于支持登出/踢人/在线状态监控（JWT 本身无状态，无法撤销）。
+type UserSession struct {
+	ID            uint64     `gorm:"primaryKey;autoIncrement" json:"id"`
+	ShopID        uint64     `gorm:"not null;index:idx_session_shop_user" json:"shop_id"`
+	UserID        uint64     `gorm:"not null;index:idx_session_shop_user" json:"user_id"`
+	SID           string     `gorm:"column:sid;size:64;not null;uniqueIndex" json:"sid"` // 嵌入 JWT
+	DeviceID      string     `gorm:"size:255" json:"device_id"`
+	DeviceName    string     `gorm:"size:255" json:"device_name"`
+	Platform      string     `gorm:"size:50" json:"platform"`       // windows|macos|linux|android|ios|web
+	PlatformClass string     `gorm:"size:20;index" json:"platform_class"` // desktop|mobile|web
+	IP            string     `gorm:"size:64" json:"ip"`
+	UserAgent     string     `gorm:"size:512" json:"user_agent"`
+	CreatedAt     time.Time  `gorm:"autoCreateTime" json:"created_at"`
+	LastSeenAt    time.Time  `gorm:"autoCreateTime" json:"last_seen_at"`
+	RevokedAt     *time.Time `gorm:"index" json:"revoked_at,omitempty"`
+	RevokedReason string     `gorm:"size:30" json:"revoked_reason,omitempty"` // kicked|logout|admin|disabled
+	RefreshExpAt  time.Time  `json:"refresh_exp_at"`
+}
+
+func (UserSession) TableName() string { return "user_sessions" }
+
+// PlatformClass 把具体平台归类，用于按类限并发。
+func PlatformClass(platform string) string {
+	switch platform {
+	case "android", "ios":
+		return "mobile"
+	case "web":
+		return "web"
+	case "windows", "macos", "linux":
+		return "desktop"
+	default:
+		return "desktop" // 未知平台按桌面端处理
+	}
+}