chore: release server-v1.0.56

会话/设备管理后端：user_sessions 会话表、JWT 加 sid 校验、按平台类限并发登录、
登录失败锁定、修复禁用账号仍可凭 refresh 续期漏洞、/auth/ping、/auth/logout、
GET /sessions、DELETE /sessions/:id（管理员强制下线）。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/testutil/setup.go

@@ -30,6 +30,13 @@ func InitConfig() {
 		License: config.LicenseConfig{
 			HMACSecret: "test-license-hmac-secret",
 		},
+		Session: config.SessionConfig{
+			LimitDesktop: 2,
+			LimitMobile:  2,
+			LimitWeb:     2,
+			MaxFailures:  5,
+			LockMinutes:  15,
+		},
 	}
 }
 
@@ -76,9 +83,27 @@ func SetupTestDB() *gorm.DB {
 			phone TEXT,
 			role TEXT DEFAULT 'operator',
 			is_active INTEGER DEFAULT 1,
+			last_login_at DATETIME,
 			custom_fields TEXT
 		)`,
 		`CREATE UNIQUE INDEX IF NOT EXISTS uk_shop_username ON users(shop_id, username)`,
+		`CREATE TABLE IF NOT EXISTS user_sessions (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			shop_id INTEGER NOT NULL,
+			user_id INTEGER NOT NULL,
+			sid TEXT NOT NULL UNIQUE,
+			device_id TEXT,
+			device_name TEXT,
+			platform TEXT,
+			platform_class TEXT,
+			ip TEXT,
+			user_agent TEXT,
+			created_at DATETIME,
+			last_seen_at DATETIME,
+			revoked_at DATETIME,
+			revoked_reason TEXT,
+			refresh_exp_at DATETIME
+		)`,
 		`CREATE TABLE IF NOT EXISTS licenses (
 			id INTEGER PRIMARY KEY AUTOINCREMENT,
 			created_at DATETIME,