feat(auth): add device session tracking with configurable limits

Track authenticated sessions per device (parsing user-agent for desktop
vs mobile via mileusna/useragent), enforce configurable concurrent device
limits (Auth.DeviceLimits), and surface device status and "remove other
devices" management in the account dialog. Adds device/session context to
the auth module stores and exposes limits through the API.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

server/README.md

@@ -47,6 +47,10 @@ JobQueue:
   MaxRetry: 3
   TimeoutSeconds: 900
   ShutdownTimeoutSeconds: 30
+Auth:
+  DeviceLimits:
+    Desktop: 2
+    Mobile: 1
 Sharing:
   EncryptionSecretEnv: SHARING_ENCRYPTION_SECRET
 Agent:
@@ -77,6 +81,8 @@ ObjectStorage:
   ExpiresIn: 900
 ```
 
+`Auth.DeviceLimits` is the source of truth for the desktop and mobile web-session counts shown in account device management. The effective values are returned by `GET /api/account/devices`.
+
 `Agent.Image.InputImageTransport` controls how input/reference images are sent to the image model for edit/image-to-image calls: `file` uploads image bytes with multipart form data, while `url` sends `images: [{"image_url": "..."}]` for gateways that can fetch public URLs directly.
 
 Start local Docker dependencies for debugging: