feat(devices): P2 sessions 表 + 在线/最后登录/客户端版本

migration 000016(mysql+sqlite,含 down):新增 sessions 表(绑 device+refresh JTI)
+ devices 加 client_version/totp_trusted_until。devices 唯一键改 + platform CHECK
加 linux(需 SQLite 表重建)拆出后续迁移,降风险。

后端:新 internal/sessions Store(Create/Rotate/Revoke/RevokeByDevice/
LastLoginByDevice);TokenManager 外露 refresh JTI(IssueWithJTI/RefreshWithJTI/
ParseRefreshJTI);auth.Service 注入 SessionStore——登录建会话、刷新轮换、登出吊销;
DeviceRegistrar 返回 deviceID;ReportUsage 心跳 touch devices.last_seen(在线判定);
devices.ListDevices 经 LastLoginSource 注入返回 online(last_seen<3min)/client_version/
last_login;RegisterIfAbsent 存 client_version。
客户端:Device model 加 online/clientVersion/lastLogin(fromJson 自动解析)。
测试:sessions store 3 例 + ListDevices 在线/最后登录 + device model 2 例 +
migration v16;全量 go test/flutter test 绿。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/internal/devices/devices_integration_test.go

@@ -187,7 +187,7 @@ func TestFullChain(t *testing.T) {
 	in := devices.RegisterInput{UserID: userID, DeviceUUID: devUUID, Name: "iPhone 15 Pro", Platform: "ios", MaxDevices: plan.MaxDevices}
 
 	// First sight → insert.
-	d1, apiErr := svc.RegisterIfAbsent(ctx, in)
+	_, d1, apiErr := svc.RegisterIfAbsent(ctx, in)
 	if apiErr != nil {
 		t.Fatalf("RegisterIfAbsent: %v", apiErr)
 	}
@@ -196,7 +196,7 @@ func TestFullChain(t *testing.T) {
 	}
 
 	// Second sight → idempotent (no new row), last_seen refreshed.
-	if _, apiErr := svc.RegisterIfAbsent(ctx, in); apiErr != nil {
+	if _, _, apiErr := svc.RegisterIfAbsent(ctx, in); apiErr != nil {
 		t.Fatalf("re-register: %v", apiErr)
 	}
 	list, apiErr := svc.ListDevices(ctx, userID)
@@ -245,12 +245,12 @@ func TestDeviceLimitEnforced(t *testing.T) {
 	}
 
 	first := devices.RegisterInput{UserID: userID, DeviceUUID: newUUID(t, db), Name: "Pixel", Platform: "android", MaxDevices: 1}
-	if _, apiErr := svc.RegisterIfAbsent(ctx, first); apiErr != nil {
+	if _, _, apiErr := svc.RegisterIfAbsent(ctx, first); apiErr != nil {
 		t.Fatalf("first register: %v", apiErr)
 	}
 
 	second := devices.RegisterInput{UserID: userID, DeviceUUID: newUUID(t, db), Name: "iPad", Platform: "ios", MaxDevices: 1}
-	_, apiErr := svc.RegisterIfAbsent(ctx, second)
+	_, _, apiErr := svc.RegisterIfAbsent(ctx, second)
 	if apiErr == nil {
 		t.Fatal("expected second register to be rejected")
 	}
@@ -269,7 +269,7 @@ func TestDeleteOthersDevice(t *testing.T) {
 	other := createUser(t, db, "other@example.com", "active")
 
 	devUUID := newUUID(t, db)
-	if _, apiErr := svc.RegisterIfAbsent(ctx, devices.RegisterInput{
+	if _, _, apiErr := svc.RegisterIfAbsent(ctx, devices.RegisterInput{
 		UserID: owner, DeviceUUID: devUUID, Name: "Mac", Platform: "macos", MaxDevices: 5,
 	}); apiErr != nil {
 		t.Fatalf("register: %v", apiErr)
@@ -308,7 +308,7 @@ func TestHTTPHandlers(t *testing.T) {
 	giveSubscription(t, db, userID, "pro", "code", time.Now().UTC().Add(30*24*time.Hour))
 
 	devUUID := newUUID(t, db)
-	if _, apiErr := svc.RegisterIfAbsent(ctx, devices.RegisterInput{
+	if _, _, apiErr := svc.RegisterIfAbsent(ctx, devices.RegisterInput{
 		UserID: userID, DeviceUUID: devUUID, Name: "Win", Platform: "windows", MaxDevices: 5,
 	}); apiErr != nil {
 		t.Fatalf("register: %v", apiErr)