feat(devices): P3 强制退出 + 清除增强(per-device 凭证吊销)

后端:新端点 POST /v1/me/devices/{uuid}/logout(ForceLogout:吊销该设备会话+
丢 Redis JTI,设备留列表)。DeleteDevice 增强:先吊销会话再删设备(FK ON DELETE
CASCADE 清理会话行)+ 按 dp_uuid 吊销数据面凭证。CredentialRevoker 接口改
per-device RevokeDevice(dpUUID),由 nodes.Service 实现(查 connect_credentials
持有节点→推 CommandTypeRevoke + 删凭证行),main 注入替 NoopRevoker;devices 注入
SessionPort/JTIRevoker。修 SQLite 跨连接死锁(会话吊销移到 delete tx 之前)。
migration 000016 sessions FK 加 ON DELETE CASCADE。
客户端:account_api.forceLogout + devicesProvider.forceLogout(UI 留 P6)。
测试:ForceLogout(吊销会话+JTI+设备保留+403/404)+ DeleteDevice(级联+按 dp_uuid
吊销);NoopRevoker 改 dp_uuid;全量 server/flutter 测试绿。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/internal/nodes/grpc_test.go

@@ -109,6 +109,10 @@ func (m *mockNodeStore) DeleteCredential(_ context.Context, _ int64, _ string) e
 	return nil
 }
 
+func (m *mockNodeStore) NodesHoldingCredential(_ context.Context, _ string) ([]nodes.CredentialLocation, error) {
+	return nil, nil
+}
+
 func (m *mockNodeStore) AccumulateUsage(_ context.Context, userID int64, date time.Time,
 	bytesUp, bytesDown, minutes int64,
 ) error {

server/internal/nodes/service.go

@@ -1,6 +1,8 @@
 package nodes
 
 import (
+	"context"
+
 	"github.com/redis/go-redis/v9"
 
 	"github.com/wangjia/pangolin/server/internal/mtls"
@@ -54,6 +56,28 @@ func (s *Service) Store() NodeStore {
 	return s.store
 }
 
+// RevokeDevice recalls a per-device data-plane credential: it pushes a Revoke
+// command to every node currently holding the dp_uuid (so sing-box drops that
+// user) and removes the connect_credentials rows. Satisfies devices.CredentialRevoker.
+// Best-effort: a queued Push is replayed when an offline node reconnects.
+func (s *Service) RevokeDevice(ctx context.Context, dpUUID string) error {
+	if dpUUID == "" {
+		return nil
+	}
+	locs, err := s.store.NodesHoldingCredential(ctx, dpUUID)
+	if err != nil {
+		return err
+	}
+	for _, loc := range locs {
+		_ = s.hub.Push(ctx, loc.NodeUUID, &agentv1.Command{
+			Type:   agentv1.CommandTypeRevoke,
+			Revoke: &agentv1.RevokePayload{DpUUID: dpUUID},
+		})
+		_ = s.store.DeleteCredential(ctx, loc.NodeID, dpUUID)
+	}
+	return nil
+}
+
 // Load exposes the LoadCache for callers that display per-node load metrics.
 func (s *Service) Load() *LoadCache {
 	return s.load

server/internal/nodes/store.go

@@ -69,6 +69,10 @@ type NodeStore interface {
 	// DeleteCredential removes the credential for (nodeID, dpUUID).
 	DeleteCredential(ctx context.Context, nodeID int64, dpUUID string) error
 
+	// NodesHoldingCredential returns the nodes (id+uuid) that currently hold a
+	// connect_credentials row for dpUUID — the targets of a per-device revoke.
+	NodesHoldingCredential(ctx context.Context, dpUUID string) ([]CredentialLocation, error)
+
 	// UserIDByDpUUID maps a data-plane UUID to the owning user's internal ID.
 	// Returns (0, false, nil) if the dp_uuid is unknown or the user is inactive.
 	UserIDByDpUUID(ctx context.Context, dpUUID string) (int64, bool, error)
@@ -290,6 +294,32 @@ func (s *SQLNodeStore) PersistCredential(ctx context.Context, nodeID int64, cred
 	return nil
 }
 
+// CredentialLocation identifies a node holding a given dp_uuid credential.
+type CredentialLocation struct {
+	NodeID   int64
+	NodeUUID string
+}
+
+// NodesHoldingCredential lists the nodes that currently hold dpUUID.
+func (s *SQLNodeStore) NodesHoldingCredential(ctx context.Context, dpUUID string) ([]CredentialLocation, error) {
+	rows, err := s.db.QueryContext(ctx,
+		`SELECT cc.node_id, n.uuid FROM connect_credentials cc
+		 JOIN nodes n ON n.id = cc.node_id WHERE cc.dp_uuid = ?`, dpUUID)
+	if err != nil {
+		return nil, fmt.Errorf("nodes.SQLNodeStore.NodesHoldingCredential: %w", err)
+	}
+	defer rows.Close()
+	var out []CredentialLocation
+	for rows.Next() {
+		var loc CredentialLocation
+		if err := rows.Scan(&loc.NodeID, &loc.NodeUUID); err != nil {
+			return nil, fmt.Errorf("nodes.SQLNodeStore.NodesHoldingCredential scan: %w", err)
+		}
+		out = append(out, loc)
+	}
+	return out, rows.Err()
+}
+
 // DeleteCredential removes the credential for (nodeID, dpUUID).
 func (s *SQLNodeStore) DeleteCredential(ctx context.Context, nodeID int64, dpUUID string) error {
 	if _, err := s.db.ExecContext(ctx,