Add an Account page for sign-in methods and signed-in devices

/web/account, offered to everyone, lists every browser and client signed
in as you, with when each was last used, and signs any of them out, or all
but the current one. It sets up, replaces and removes the second factor,
and holds the password form, moved from the vault page. Administrators can
sign a user out everywhere from the People page.

The API gains GET and DELETE /api/v1/auth/sessions and DELETE
/api/v1/auth/totp. Sessions are named by a digest of their token, never the
token, and record when they were last used. Replacing or removing an active
second factor now needs the password and a current code.

Server version 0.10.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/admin.go

@@ -324,6 +324,7 @@ const (
 	accountPromote   accountAction = "promote"
 	accountDemote    accountAction = "demote"
 	accountClearTOTP accountAction = "clear-totp"
+	accountSignOut   accountAction = "sign-out"
 	accountDelete    accountAction = "delete"
 )
 
@@ -361,6 +362,10 @@ func adminAccount(st *store.State, u *store.User, ref string, act accountAction)
 		target.ServerAdmin = false
 	case accountClearTOTP:
 		target.TOTPSecret, target.TOTPConfirmed = "", false
+	case accountSignOut:
+		// For a lost phone or laptop: every device must sign in again,
+		// and the account stays usable.
+		revokeSessions(st, target.ID)
 	case accountDelete:
 		delete(st.Users, target.ID)
 		revokeSessions(st, target.ID)