feat(auth): add device session tracking with configurable limits

Track authenticated sessions per device (parsing user-agent for desktop
vs mobile via mileusna/useragent), enforce configurable concurrent device
limits (Auth.DeviceLimits), and surface device status and "remove other
devices" management in the account dialog. Adds device/session context to
the auth module stores and exposes limits through the API.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

server/internal/infrastructure/postgres/schema.sql

@@ -43,6 +43,27 @@ CREATE TABLE IF NOT EXISTS auth_verification_codes (
 
 CREATE INDEX IF NOT EXISTS auth_codes_target_idx ON auth_verification_codes(region, channel, target, purpose, created_at DESC);
 
+CREATE TABLE IF NOT EXISTS auth_device_sessions (
+    id TEXT PRIMARY KEY,
+    user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    device_type TEXT NOT NULL DEFAULT 'desktop',
+    system TEXT NOT NULL DEFAULT 'unknown',
+    browser TEXT NOT NULL DEFAULT 'unknown',
+    client TEXT NOT NULL DEFAULT 'PC-WEB',
+    user_agent TEXT NOT NULL DEFAULT '',
+    created_at TIMESTAMPTZ NOT NULL,
+    last_seen_at TIMESTAMPTZ NOT NULL,
+    expires_at TIMESTAMPTZ NOT NULL,
+    revoked_at TIMESTAMPTZ
+);
+
+CREATE INDEX IF NOT EXISTS auth_device_sessions_user_active_idx
+    ON auth_device_sessions(user_id, last_seen_at DESC)
+    WHERE revoked_at IS NULL;
+CREATE INDEX IF NOT EXISTS auth_device_sessions_expiry_idx
+    ON auth_device_sessions(expires_at)
+    WHERE revoked_at IS NULL;
+
 CREATE TABLE IF NOT EXISTS brand_kits (
     id TEXT PRIMARY KEY,
     user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,