fix(security): Revoke account sessions and bound build resources

[yuanzui-cf]

Summary

Disabling an account or recovering its password previously left existing sessions usable, while build logs and container exports could grow Node memory without a bound.

• Check active account state and a database-backed authentication version at HTTP, preview, and live-log authorization boundaries. Disabling an account increments the version; re-enabling it cannot revive old sessions.
• Commit password updates and version increments atomically. Self-service changes, recovery, and administrator resets invalidate all previous sessions and pending MFA challenges; the Console returns users to login after a password change.
• Bound log lines, total log bytes, persistence queues, and realtime queues. Stream container archives through temporary files with byte, entry, metadata, and time budgets; preserve path protections and clean up failed or canceled builds.
• Remove the completed code-cleanup section from the TODO.

Validation

• just quality: passed; Rust reported 671 passing tests and Console 239 passing tests across 63 files. The default Rust suite excludes 18 explicitly ignored tests; 15 of those were run separately below.
• cargo test -p grass-control-api infra::database::migrate::tests:: -- --ignored: 13 passed on disposable PostgreSQL, including authentication-version column shape, constraints, migration tracking, and account/password revocation using both Moka and Redis. Covered delayed stale cache writes and login with each new password.
• cargo test -p grass-control-api redis_rejects_revoked_accounts_at_read_and_write_boundaries -- --ignored: passed against disposable Redis.
• cargo test -p grass-node docker_build_exports_logs_and_failure_cleanup -- --ignored: passed against Docker, covering static/SSR directory exports, excessive logs, timeout, symlink rejection, and container cleanup.
• cargo test -p grass-cache: 12 passed with the real Redis tests enabled.
• Temporary test schemas, containers, data, and runtime credentials were removed after validation.

Tracking

Closes #203
Closes #204
Closes #205
Closes #202 (parent issue)

Known Limitations

• The new migration adds users.auth_version. Pre-upgrade sessions lack a valid version and require a fresh login. Password changes intentionally invalidate the initiating session as well.
• Authenticated session validation now reads current account state from PostgreSQL; database failures fail closed.
• Builds exceeding the resource budgets fail. Realtime frames may be dropped when their bounded queue fills; persistent logs apply backpressure and a total byte budget.
• Backend and Docker regressions use disposable services and bounded fixtures; they are not a full deployed end-to-end test or an actual OOM experiment.