chore: release server-v1.0.56

会话/设备管理后端：user_sessions 会话表、JWT 加 sid 校验、按平台类限并发登录、
登录失败锁定、修复禁用账号仍可凭 refresh 续期漏洞、/auth/ping、/auth/logout、
GET /sessions、DELETE /sessions/:id（管理员强制下线）。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/schema/schema.sql

@@ -42,6 +42,7 @@ CREATE TABLE IF NOT EXISTS `users` (
   `phone`         VARCHAR(30)     DEFAULT NULL,
   `role`          ENUM('admin','operator','readonly','superadmin') NOT NULL DEFAULT 'operator',
   `is_active`     TINYINT(1)      NOT NULL DEFAULT 1,
+  `last_login_at` DATETIME        DEFAULT NULL COMMENT '最近登录时间',
   `custom_fields` JSON            DEFAULT NULL,
   `created_at`    DATETIME        NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at`    DATETIME        NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
@@ -52,6 +53,32 @@ CREATE TABLE IF NOT EXISTS `users` (
   KEY `idx_deleted_at` (`deleted_at`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='用户';
 
+-- ------------------------------------------------------------
+-- 登录会话（支持登出/踢人/在线状态监控；JWT 的 sid claim 指向此表）
+-- ------------------------------------------------------------
+CREATE TABLE IF NOT EXISTS `user_sessions` (
+  `id`             BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
+  `shop_id`        BIGINT UNSIGNED NOT NULL,
+  `user_id`        BIGINT UNSIGNED NOT NULL,
+  `sid`            VARCHAR(64)     NOT NULL COMMENT '嵌入 JWT 的会话标识',
+  `device_id`      VARCHAR(255)    DEFAULT NULL,
+  `device_name`    VARCHAR(255)    DEFAULT NULL,
+  `platform`       VARCHAR(50)     DEFAULT NULL COMMENT 'windows|macos|linux|android|ios|web',
+  `platform_class` VARCHAR(20)     DEFAULT NULL COMMENT 'desktop|mobile|web',
+  `ip`             VARCHAR(64)     DEFAULT NULL,
+  `user_agent`     VARCHAR(512)    DEFAULT NULL,
+  `created_at`     DATETIME        NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  `last_seen_at`   DATETIME        NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  `revoked_at`     DATETIME        DEFAULT NULL,
+  `revoked_reason` VARCHAR(30)     DEFAULT NULL COMMENT 'kicked|logout|admin|disabled',
+  `refresh_exp_at` DATETIME        DEFAULT NULL,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `uk_session_sid` (`sid`),
+  KEY `idx_session_shop_user` (`shop_id`, `user_id`),
+  KEY `idx_session_class` (`platform_class`),
+  KEY `idx_session_revoked` (`revoked_at`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='登录会话';
+
 -- ------------------------------------------------------------
 -- 许可证
 -- ------------------------------------------------------------