Add an Account page for sign-in methods and signed-in devices

/web/account, offered to everyone, lists every browser and client signed
in as you, with when each was last used, and signs any of them out, or all
but the current one. It sets up, replaces and removes the second factor,
and holds the password form, moved from the vault page. Administrators can
sign a user out everywhere from the People page.

The API gains GET and DELETE /api/v1/auth/sessions and DELETE
/api/v1/auth/totp. Sessions are named by a digest of their token, never the
token, and record when they were last used. Replacing or removing an active
second factor now needs the password and a current code.

Server version 0.10.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/webadmin.go

@@ -55,6 +55,7 @@ func (s *Server) shell(sess *webSession, title, current string) map[string]any {
 			navItem{Label: "People", Href: "/web/users"},
 			navItem{Label: "Invites", Href: "/web/invites"})
 	}
+	nav = append(nav, navItem{Label: "Account", Href: "/web/account"})
 	for i := range nav {
 		nav[i].Current = nav[i].Label == current
 	}
@@ -403,6 +404,8 @@ func accountNotice(username string, act accountAction) string {
 		return username + " is no longer a server administrator."
 	case accountClearTOTP:
 		return username + " can sign in without a one-time code and should enrol a new one."
+	case accountSignOut:
+		return username + " is signed out on every device and browser."
 	case accountDelete:
 		return username + " was deleted, along with their group memberships and sessions."
 	}