feat(devices): P2 sessions 表 + 在线/最后登录/客户端版本

migration 000016(mysql+sqlite,含 down):新增 sessions 表(绑 device+refresh JTI)
+ devices 加 client_version/totp_trusted_until。devices 唯一键改 + platform CHECK
加 linux(需 SQLite 表重建)拆出后续迁移,降风险。

后端:新 internal/sessions Store(Create/Rotate/Revoke/RevokeByDevice/
LastLoginByDevice);TokenManager 外露 refresh JTI(IssueWithJTI/RefreshWithJTI/
ParseRefreshJTI);auth.Service 注入 SessionStore——登录建会话、刷新轮换、登出吊销;
DeviceRegistrar 返回 deviceID;ReportUsage 心跳 touch devices.last_seen(在线判定);
devices.ListDevices 经 LastLoginSource 注入返回 online(last_seen<3min)/client_version/
last_login;RegisterIfAbsent 存 client_version。
客户端:Device model 加 online/clientVersion/lastLogin(fromJson 自动解析)。
测试:sessions store 3 例 + ListDevices 在线/最后登录 + device model 2 例 +
migration v16;全量 go test/flutter test 绿。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/internal/auth/device_register_test.go

@@ -11,15 +11,16 @@ type fakeRegistrar struct {
 		userID int64
 		meta   DeviceMeta
 	}
-	err error
+	deviceID int64
+	err      error
 }
 
-func (f *fakeRegistrar) RegisterDevice(_ context.Context, userID int64, meta DeviceMeta) error {
+func (f *fakeRegistrar) RegisterDevice(_ context.Context, userID int64, meta DeviceMeta) (int64, error) {
 	f.calls = append(f.calls, struct {
 		userID int64
 		meta   DeviceMeta
 	}{userID, meta})
-	return f.err
+	return f.deviceID, f.err
 }
 
 // Register/Login with a device should trigger RegisterDevice with the meta.
@@ -36,7 +37,7 @@ func TestService_RegisterDevice_OnRegisterAndLogin(t *testing.T) {
 		t.Fatalf("SendCode: %v", err)
 	}
 	code := codeInRedis(t, svc, email)
-	if _, e := svc.Register(ctx, email, code, pw, meta); e != nil {
+	if _, e := svc.Register(ctx, email, code, pw, "1.2.3.4", meta); e != nil {
 		t.Fatalf("Register: %v", e)
 	}
 	if len(reg.calls) != 1 || reg.calls[0].meta.DeviceID != "dev-uuid-1" || reg.calls[0].meta.Platform != "macos" {
@@ -64,7 +65,7 @@ func TestService_RegisterDevice_BestEffort(t *testing.T) {
 		t.Fatalf("SendCode: %v", err)
 	}
 	code := codeInRedis(t, svc, email)
-	if _, e := svc.Register(ctx, email, code, "supersecret", DeviceMeta{DeviceID: "x", Platform: "windows"}); e != nil {
+	if _, e := svc.Register(ctx, email, code, "supersecret", "", DeviceMeta{DeviceID: "x", Platform: "windows"}); e != nil {
 		t.Fatalf("Register must succeed despite registrar error: %v", e)
 	}
 }
@@ -80,7 +81,7 @@ func TestService_RegisterDevice_NoMeta(t *testing.T) {
 		t.Fatalf("SendCode: %v", err)
 	}
 	code := codeInRedis(t, svc, email)
-	if _, e := svc.Register(ctx, email, code, "supersecret", DeviceMeta{}); e != nil {
+	if _, e := svc.Register(ctx, email, code, "supersecret", "", DeviceMeta{}); e != nil {
 		t.Fatalf("Register: %v", e)
 	}
 	if len(reg.calls) != 0 {