Add session management with active session listing and revocation

[Mystery-CLI]

🔧 Title: Add session management with active session listing and revocation

📘 Description
Users have no visibility into their active sessions and cannot revoke a session if their device is lost or stolen. This is a basic security feature for any financial application.

✅ Acceptance Criteria

• Store session metadata (device, IP, last active) in a Session database model
• Add GET /api/auth/sessions endpoint listing all active sessions
• Add DELETE /api/auth/sessions/:id to revoke a specific session
• Add DELETE /api/auth/sessions to revoke all sessions (logout everywhere)
• Show active sessions in AccountSettings.jsx
• Add tests for session listing and revocation

🔧 Context: backend/src/routes/auth.js; frontend/src/components/AccountSettings.jsx.

---