feat(auth): Active Devices — view/revoke mobile sessions

Adds the self-service device-session surface the mobile-SSO spec requires, on
top of the existing mobile_refresh_tokens store.

- Schema: device_name + last_used_at columns on mobile_refresh_tokens (nullable,
  additive via the ALTER section; seeded to now on insert). With single-use
  rotation each login/refresh inserts a fresh row, so the active row's timestamp
  is the session's last activity, and the label is carried forward on refresh.
- Model: listActiveForUser (one row per live device, no token hash) +
  revokeByIdForUser (ownership-scoped, idempotent).
- GET /auth/me/sessions + DELETE /auth/me/sessions/:id (role-agnostic, behind
  requireAuth). Named distinctly from /auth/me/devices (push endpoints).
- device_name is an optional field on /auth/mobile/login and
  /auth/mobile/sso/exchange so the app can label a device.
- Client: an "Active Devices" panel on the player account page (list + sign a
  device out), plus the PlayerLogin change to honor the mobile SSO bridge's
  { redirect } deep link on a 2FA completion.
- Swagger DeviceSession schema + regenerated spec; 3 controller tests. Full
  server suite green (274); client builds.

Co-Authored-By: Claude <noreply@anthropic.com>

server/src/router/v1/auth/me.routes.js

@@ -137,4 +137,31 @@ meRouter.delete(
   account.unlinkIdentity,
 )
 
+// Active mobile device sessions (self-service). Distinct from /auth/me/devices,
+// which is push-notification endpoints — these are login sessions (M9). List the
+// active ones and revoke a single device without "log out everywhere".
+meRouter.get(
+  '/sessions',
+  // #swagger.tags = ['Auth · Me']
+  // #swagger.summary = 'List active mobile device sessions (self)'
+  // #swagger.description = 'Active (unrevoked, unexpired) mobile bearer sessions — one per live device — for the Active Devices screen. Never returns tokens.'
+  // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
+  /* #swagger.responses[200] = { description: 'Active device sessions', content: { "application/json": { schema: { type: "array", items: { $ref: "#/components/schemas/DeviceSession" } } } } } */
+  /* #swagger.responses[401] = { description: 'Not authenticated', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
+  account.listSessions,
+)
+meRouter.delete(
+  '/sessions/:id',
+  // #swagger.tags = ['Auth · Me']
+  // #swagger.summary = 'Revoke one mobile device session (self)'
+  // #swagger.description = 'Revokes a single device by its session id (ownership-scoped). Revoking stops future token renewals; an already-issued access token remains valid until it expires (see the documented revocation-latency window).'
+  // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
+  // #swagger.parameters['id'] = { in: 'path', required: true, schema: { type: 'integer' }, description: 'The session row id from GET /auth/me/sessions.' }
+  /* #swagger.responses[200] = { description: 'Revoked (idempotent)', content: { "application/json": { schema: { type: "object", properties: { revoked: { type: "boolean" } } } } } } */
+  /* #swagger.responses[401] = { description: 'Not authenticated', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
+  param('id').isInt({ min: 1 }),
+  validate,
+  account.revokeSession,
+)
+
 module.exports = meRouter

server/src/router/v1/auth/mobile.controller.js

@@ -37,11 +37,14 @@ function tokenResponse(out, user) {
 
 // Persist a freshly minted refresh token (by hash) and record the login. Shared
 // by login and refresh so the storage/side-effect logic lives in one place.
-async function persistAndFinish(req, user, out, action) {
+// `deviceName` is the friendly label for the Active Devices list — supplied by
+// the client at login and carried forward across rotations on refresh.
+async function persistAndFinish(req, user, out, action, deviceName = null) {
   await mobileSessions.store({
     userId: user.id,
     tokenHash: out.refreshHash,
     deviceHash: out.deviceHash,
+    deviceName,
     userAgent: out.userAgent,
     expiresAt: out.refreshExpiresAt,
   })
@@ -79,7 +82,7 @@ async function login(req, res) {
     loginProtection.recordSuccess(req.ip)
     const meta = sessionService.sessionMeta(req)
     const out = sessionService.createMobileSession(user, meta)
-    await persistAndFinish(req, user, out, 'auth.mobile.login')
+    await persistAndFinish(req, user, out, 'auth.mobile.login', req.body.device_name || null)
     log.info('mobile login success', { username: user.username, id: user.id, ip: req.ip })
     return res.json(tokenResponse(out, user))
   } catch (err) {
@@ -111,7 +114,9 @@ async function refresh(req, res) {
     await mobileSessions.revokeByHash(hash) // rotate: old token is now dead
     const meta = sessionService.sessionMeta(req)
     const out = sessionService.refreshMobileSession(user, meta)
-    await persistAndFinish(req, user, out, 'auth.mobile.refresh')
+    // Carry the device label forward across rotation so the Active Devices list
+    // stays labeled for the life of the session.
+    await persistAndFinish(req, user, out, 'auth.mobile.refresh', row.device_name || null)
     log.info('mobile session refreshed', { id: user.id, ip: req.ip })
     return res.json(tokenResponse(out, user))
   } catch (err) {

server/src/router/v1/auth/mobile.routes.js

@@ -36,6 +36,8 @@ mobileRouter.post(
   body('password').isString().notEmpty(),
   // Optional TOTP code (single-request 2FA); only checked when the account has 2FA on.
   body('code').optional().isString().trim().isLength({ min: 6, max: 8 }),
+  // Optional friendly device label for the Active Devices list.
+  body('device_name').optional({ values: 'falsy' }).isString().trim().isLength({ max: 100 }),
   validate,
   login,
 )

server/src/router/v1/auth/mobileSso.controller.js

@@ -131,6 +131,7 @@ async function exchange(req, res) {
       userId: user.id,
       tokenHash: out.refreshHash,
       deviceHash: out.deviceHash,
+      deviceName: req.body.device_name || null,
       userAgent: out.userAgent,
       expiresAt: out.refreshExpiresAt,
     })

server/src/router/v1/auth/mobileSso.routes.js

@@ -48,6 +48,7 @@ mobileSsoRouter.post(
   mobileSsoExchangeLimiter,
   body('code').isString().trim().isLength({ min: 20, max: 255 }),
   body('code_verifier').isString().trim().isLength({ min: 20, max: 255 }),
+  body('device_name').optional({ values: 'falsy' }).isString().trim().isLength({ max: 100 }),
   validate,
   exchange,
 )