feat(devices): P2 sessions 表 + 在线/最后登录/客户端版本

migration 000016(mysql+sqlite,含 down):新增 sessions 表(绑 device+refresh JTI)
+ devices 加 client_version/totp_trusted_until。devices 唯一键改 + platform CHECK
加 linux(需 SQLite 表重建)拆出后续迁移,降风险。

后端:新 internal/sessions Store(Create/Rotate/Revoke/RevokeByDevice/
LastLoginByDevice);TokenManager 外露 refresh JTI(IssueWithJTI/RefreshWithJTI/
ParseRefreshJTI);auth.Service 注入 SessionStore——登录建会话、刷新轮换、登出吊销;
DeviceRegistrar 返回 deviceID;ReportUsage 心跳 touch devices.last_seen(在线判定);
devices.ListDevices 经 LastLoginSource 注入返回 online(last_seen<3min)/client_version/
last_login;RegisterIfAbsent 存 client_version。
客户端:Device model 加 online/clientVersion/lastLogin(fromJson 自动解析)。
测试:sessions store 3 例 + ListDevices 在线/最后登录 + device model 2 例 +
migration v16;全量 go test/flutter test 绿。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/internal/auth/token.go

@@ -113,27 +113,34 @@ func NewTokenManager(rdb *redis.Client, cfg TokenConfig) (*TokenManager, error)
 	}, nil
 }
 
-// Issue mints a fresh access+refresh pair for the user and whitelists the
-// refresh JTI in Redis with the refresh TTL.
-func (tm *TokenManager) Issue(ctx context.Context, userID int64, userUUID string) (*TokenPair, error) {
+// IssueWithJTI mints a fresh access+refresh pair, whitelists the refresh JTI in
+// Redis, and returns that JTI so the caller can bind a session to the refresh
+// token. Issue wraps this when the JTI isn't needed.
+func (tm *TokenManager) IssueWithJTI(ctx context.Context, userID int64, userUUID string) (*TokenPair, string, error) {
 	now := tm.now()
 
 	access, _, err := tm.sign(userID, userUUID, typAccess, tm.accessTTL, now)
 	if err != nil {
-		return nil, err
+		return nil, "", err
 	}
 	refresh, refreshJTI, err := tm.sign(userID, userUUID, typRefresh, tm.refreshTTL, now)
 	if err != nil {
-		return nil, err
+		return nil, "", err
 	}
 	if err := tm.whitelist(ctx, refreshJTI, userID); err != nil {
-		return nil, err
+		return nil, "", err
 	}
 	return &TokenPair{
 		AccessToken:  access,
 		RefreshToken: refresh,
 		ExpiresIn:    int(tm.accessTTL.Seconds()),
-	}, nil
+	}, refreshJTI, nil
+}
+
+// Issue mints a fresh access+refresh pair (refresh JTI discarded).
+func (tm *TokenManager) Issue(ctx context.Context, userID int64, userUUID string) (*TokenPair, error) {
+	pair, _, err := tm.IssueWithJTI(ctx, userID, userUUID)
+	return pair, err
 }
 
 // sign builds and signs one token, returning the compact string and its JTI.
@@ -206,13 +213,13 @@ func (tm *TokenManager) ParseAccess(tokenStr string) (*Claims, error) {
 	return tm.parse(tokenStr, typAccess)
 }
 
-// Refresh validates a refresh token against the Redis whitelist, then rotates:
-// the old JTI is deleted and a brand-new access+refresh pair is issued, so the
-// presented refresh token can never be replayed.
-func (tm *TokenManager) Refresh(ctx context.Context, refreshToken string) (*TokenPair, error) {
+// RefreshWithJTI validates+rotates a refresh token (single-use) and returns the
+// old and new refresh JTIs so the caller can move the bound session. Refresh
+// wraps this when the JTIs aren't needed.
+func (tm *TokenManager) RefreshWithJTI(ctx context.Context, refreshToken string) (pair *TokenPair, oldJTI, newJTI string, err error) {
 	claims, err := tm.parse(refreshToken, typRefresh)
 	if err != nil {
-		return nil, err
+		return nil, "", "", err
 	}
 
 	// Whitelist check + single-use rotation: DEL returns the number of keys
@@ -220,13 +227,23 @@ func (tm *TokenManager) Refresh(ctx context.Context, refreshToken string) (*Toke
 	// banned) → reject.
 	removed, err := tm.rdb.Del(ctx, refreshKeyPrefix+claims.ID).Result()
 	if err != nil {
-		return nil, fmt.Errorf("auth: refresh whitelist del: %w", err)
+		return nil, "", "", fmt.Errorf("auth: refresh whitelist del: %w", err)
 	}
 	if removed == 0 {
-		return nil, ErrInvalidTokenSentinel
+		return nil, "", "", ErrInvalidTokenSentinel
 	}
 
-	return tm.Issue(ctx, claims.UID, claims.Subject)
+	pair, newJTI, err = tm.IssueWithJTI(ctx, claims.UID, claims.Subject)
+	if err != nil {
+		return nil, "", "", err
+	}
+	return pair, claims.ID, newJTI, nil
+}
+
+// Refresh validates+rotates a refresh token (JTIs discarded).
+func (tm *TokenManager) Refresh(ctx context.Context, refreshToken string) (*TokenPair, error) {
+	pair, _, _, err := tm.RefreshWithJTI(ctx, refreshToken)
+	return pair, err
 }
 
 // Revoke removes a single refresh JTI from the whitelist (logout).
@@ -234,6 +251,15 @@ func (tm *TokenManager) Revoke(ctx context.Context, jti string) error {
 	return tm.rdb.Del(ctx, refreshKeyPrefix+jti).Err()
 }
 
+// ParseRefreshJTI returns a refresh token's JTI (for session lookup on logout).
+func (tm *TokenManager) ParseRefreshJTI(refreshToken string) (string, error) {
+	claims, err := tm.parse(refreshToken, typRefresh)
+	if err != nil {
+		return "", err
+	}
+	return claims.ID, nil
+}
+
 // RevokeRefresh parses a refresh token and revokes its JTI. Used by logout.
 // Returns an error only when the token is structurally invalid; a missing or
 // already-rotated JTI is a no-op (logout is idempotent).