feat(auth): add device session tracking with configurable limits

Track authenticated sessions per device (parsing user-agent for desktop
vs mobile via mileusna/useragent), enforce configurable concurrent device
limits (Auth.DeviceLimits), and surface device status and "remove other
devices" management in the account dialog. Adds device/session context to
the auth module stores and exposes limits through the API.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

server/img_infinite_canvas.api

@@ -148,8 +148,14 @@ type AccountDevice {
 	LastSeenAt string `json:"lastSeenAt"`
 }
 
+type AccountDeviceLimits {
+	Desktop int64 `json:"desktop"`
+	Mobile  int64 `json:"mobile"`
+}
+
 type AccountDeviceListResponse {
-	Devices []AccountDevice `json:"devices"`
+	Devices []AccountDevice     `json:"devices"`
+	Limits  AccountDeviceLimits `json:"limits"`
 }
 
 type AccountDeviceMutationResponse {