feat: 近实时远程下线 — 客户端轮询会话有效性(~15s),服务端 GET /v1/me/session

控制面无推送通道,access token 是无状态 JWT(15min),强制退出后被踢设备要等 token 过期
(≤15min)才登出。改成客户端每 15s 轮询会话是否仍有效,被强制退出即登出 → 延迟压到 ~15s。
- 服务端:sessions.HasActiveSession(user,device) + devices.SessionActive(按 UUID,fail-open)
  + GET /v1/me/session?device_id= 返回 {active}(恒 200,判据在 body)。无新迁移。
- 客户端:account_api.sessionActive + main.dart _RootFlowState 15s 轮询,active=false 即 logout
  (网络/鉴权异常不据此登出,fail-safe)。
- 测试:TestSQLite_SessionHasActiveSession(建会话=活跃→RevokeByDevice→非活跃)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/internal/devices/service.go

@@ -36,6 +36,7 @@ func (n *NoopRevoker) RevokeDevice(_ context.Context, dpUUID string) error {
 type SessionPort interface {
 	LastLoginByDevice(ctx context.Context, userID int64) (map[int64]time.Time, error)
 	RevokeByDevice(ctx context.Context, userID, deviceID int64) ([]string, error)
+	HasActiveSession(ctx context.Context, userID, deviceID int64) (bool, error)
 }
 
 // JTIRevoker drops a refresh JTI from the Redis whitelist. Satisfied by
@@ -342,6 +343,29 @@ func (svc *Service) RenameDevice(ctx context.Context, userID int64, deviceUUID,
 	return nil
 }
 
+// SessionActive reports whether the device (by UUID) still has a live login session
+// for the user — false after a force-logout elsewhere. The client polls this (~15s)
+// and logs out on false → near-instant remote kick. Fail-open (return true) on a
+// missing session port / blank or unknown / not-own device, so transient ambiguity
+// never spuriously logs a user out.
+func (svc *Service) SessionActive(ctx context.Context, userID int64, deviceUUID string) (bool, *apierr.Error) {
+	if svc.sessions == nil || strings.TrimSpace(deviceUUID) == "" {
+		return true, nil
+	}
+	dev, err := svc.store.FindByUUID(ctx, deviceUUID)
+	if err != nil {
+		return false, apierr.ErrInternal
+	}
+	if dev == nil || dev.UserID != userID {
+		return true, nil // 未知 / 非本人设备:不据此登出
+	}
+	active, err := svc.sessions.HasActiveSession(ctx, userID, dev.ID)
+	if err != nil {
+		return false, apierr.ErrInternal
+	}
+	return active, nil
+}
+
 // revokeDeviceSessions marks all of a device's sessions revoked and drops their
 // refresh JTIs from the Redis whitelist. Best-effort.
 func (svc *Service) revokeDeviceSessions(ctx context.Context, userID, deviceID int64) {