feat: 近实时远程下线 — 客户端轮询会话有效性(~15s),服务端 GET /v1/me/session

控制面无推送通道,access token 是无状态 JWT(15min),强制退出后被踢设备要等 token 过期
(≤15min)才登出。改成客户端每 15s 轮询会话是否仍有效,被强制退出即登出 → 延迟压到 ~15s。
- 服务端:sessions.HasActiveSession(user,device) + devices.SessionActive(按 UUID,fail-open)
  + GET /v1/me/session?device_id= 返回 {active}(恒 200,判据在 body)。无新迁移。
- 客户端:account_api.sessionActive + main.dart _RootFlowState 15s 轮询,active=false 即 logout
  (网络/鉴权异常不据此登出,fail-safe)。
- 测试:TestSQLite_SessionHasActiveSession(建会话=活跃→RevokeByDevice→非活跃)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/internal/devices/handler.go

@@ -3,6 +3,7 @@ package devices
 import (
 	"encoding/json"
 	"net/http"
+	"strings"
 
 	"github.com/go-chi/chi/v5"
 	"github.com/wangjia/pangolin/server/internal/apierr"
@@ -29,6 +30,7 @@ func (h *Handler) RegisterRoutes(r chi.Router) {
 	r.Delete("/devices/{id}", h.DeleteDevice)
 	r.Post("/devices/{id}/logout", h.ForceLogout)
 	r.Post("/devices/{id}/rename", h.RenameDevice)
+	r.Get("/session", h.SessionCheck) // GET /v1/me/session?device_id= — 会话有效性轮询
 }
 
 type listDevicesResponse struct {
@@ -89,6 +91,27 @@ func (h *Handler) ForceLogout(w http.ResponseWriter, r *http.Request) {
 	w.WriteHeader(http.StatusNoContent)
 }
 
+// SessionCheck handles GET /v1/me/session?device_id=UUID — reports whether the
+// caller's device still has a live session. false ⇒ force-logged-out elsewhere;
+// the client polls this (~15s) and logs out on {"active":false} → near-instant kick.
+// Always 200 (the verdict is in the body); device_id 取自 query。
+func (h *Handler) SessionCheck(w http.ResponseWriter, r *http.Request) {
+	userID, ok := auth.UserIDFromContext(r.Context())
+	if !ok {
+		apierr.WriteJSON(w, http.StatusUnauthorized, apierr.ErrUnauthorized)
+		return
+	}
+	deviceUUID := strings.TrimSpace(r.URL.Query().Get("device_id"))
+	active, apiErr := h.svc.SessionActive(r.Context(), userID, deviceUUID)
+	if apiErr != nil {
+		apierr.WriteJSON(w, StatusForError(apiErr), apiErr)
+		return
+	}
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	w.WriteHeader(http.StatusOK)
+	_ = json.NewEncoder(w).Encode(map[string]bool{"active": active})
+}
+
 // RenameDevice handles POST /v1/me/devices/{id}/rename — set a device's name.
 func (h *Handler) RenameDevice(w http.ResponseWriter, r *http.Request) {
 	userID, ok := auth.UserIDFromContext(r.Context())