feat(auth): add device session tracking with configurable limits

Track authenticated sessions per device (parsing user-agent for desktop
vs mobile via mileusna/useragent), enforce configurable concurrent device
limits (Auth.DeviceLimits), and surface device status and "remove other
devices" management in the account dialog. Adds device/session context to
the auth module stores and exposes limits through the API.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

server/internal/config/config.go

@@ -91,12 +91,18 @@ type AuthConfig struct {
 	RefreshTTLSeconds int64  `json:",default=2592000"`
 	CodeTTLSeconds    int64  `json:",default=600"`
 	DevReturnCode     bool   `json:",default=true"`
+	DeviceLimits      AuthDeviceLimitsConfig
 	Email             EmailAuthConfig
 	Turnstile         TurnstileAuthConfig
 	Google            GoogleAuthConfig
 	Wechat            WechatAuthConfig
 }
 
+type AuthDeviceLimitsConfig struct {
+	Desktop int64 `json:",default=2"`
+	Mobile  int64 `json:",default=1"`
+}
+
 type EmailAuthConfig struct {
 	Driver             string `json:",default=none"`
 	Host               string `json:",optional"`