sessions: every signed-in browser is a row, and one can be signed out

A session cookie now carries the id of a row in the new sessions table,
and is refused once that row is gone. :sessions lists the browsers
signed in, newest first, and :sessions rm <n> signs one out without
touching the rest; it locks the vault too, since the vault is open for
the whole workspace. Logging out deletes the row, :logout! and a login
password change delete them all, and the sweep drops expired rows.
last_seen is kept in memory and written at most every five minutes.

Cookies issued before this carry no id and are refused: every browser
logs in once more after the upgrade.

src/routes/mod.rs

@@ -41,6 +41,8 @@ pub fn api_router(max_upload: usize) -> Router<AppState> {
             post(session::login).layer(DefaultBodyLimit::max(LOGIN_LIMIT)),
         )
         .route("/logout", post(session::logout))
+        .route("/sessions", get(session::list))
+        .route("/sessions/{id}", delete(session::revoke))
         .route("/export", get(export::export))
         .route("/backup", get(backup::status).post(backup::run))
         .route("/spaces", get(nodes::spaces).post(nodes::create_space))
@@ -140,6 +142,7 @@ pub(crate) mod tests {
             login_throttle: Arc::default(),
             vault_throttle: Arc::default(),
             epoch: Arc::new(AtomicI64::new(0)),
+            sessions: Arc::default(),
             config,
             db,
         }