Add an Account page for sign-in methods and signed-in devices

/web/account, offered to everyone, lists every browser and client signed
in as you, with when each was last used, and signs any of them out, or all
but the current one. It sets up, replaces and removes the second factor,
and holds the password form, moved from the vault page. Administrators can
sign a user out everywhere from the People page.

The API gains GET and DELETE /api/v1/auth/sessions and DELETE
/api/v1/auth/totp. Sessions are named by a digest of their token, never the
token, and record when they were last used. Replacing or removing an active
second factor now needs the password and a current code.

Server version 0.10.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/model.go

@@ -145,11 +145,21 @@ type Session struct {
 	UserID string `json:"user_id"`
 	Label  string `json:"label,omitempty"`
 	// CSRF guards the browser forms of a session held in a cookie.
-	CSRF      string    `json:"csrf,omitempty"`
+	CSRF string `json:"csrf,omitempty"`
+	// Browser marks a session held in a web cookie rather than by a client
+	// application. Sessions from before the field have the label "web".
+	Browser   bool      `json:"browser,omitempty"`
 	CreatedAt time.Time `json:"created_at"`
 	ExpiresAt time.Time `json:"expires_at"`
+	// LastSeenAt is when the session last made a request, to a resolution
+	// of a few minutes: recording every request would rewrite the state
+	// document on each one.
+	LastSeenAt time.Time `json:"last_seen_at,omitempty"`
 }
 
+// IsBrowser reports whether the session belongs to a web browser.
+func (s *Session) IsBrowser() bool { return s.Browser || s.Label == "web" }
+
 // DeviceAuth backs the browser-assisted login used for OIDC on desktop and
 // Android: the client shows a short user code, the browser approves it, the
 // client polls until a session token appears.