sessions: every signed-in browser is a row, and one can be signed out

A session cookie now carries the id of a row in the new sessions table,
and is refused once that row is gone. :sessions lists the browsers
signed in, newest first, and :sessions rm <n> signs one out without
touching the rest; it locks the vault too, since the vault is open for
the whole workspace. Logging out deletes the row, :logout! and a login
password change delete them all, and the sweep drops expired rows.
last_seen is kept in memory and written at most every five minutes.

Cookies issued before this carry no id and are refused: every browser
logs in once more after the upgrade.

migrations/0017_sessions.sql

@@ -0,0 +1,11 @@
+-- Every signed-in browser gets a row, named by an id its cookie carries, so
+-- one can be listed and signed out without signing out the rest. A cookie
+-- whose row is gone is refused even though its signature still holds.
+-- The epoch in `auth` stays as a second fence: raising it ends every row too.
+CREATE TABLE sessions (
+    id TEXT PRIMARY KEY,
+    created_at INTEGER NOT NULL,
+    last_seen INTEGER NOT NULL,
+    expires_at INTEGER NOT NULL,
+    user_agent TEXT NOT NULL DEFAULT ''
+);