[VULN-22] No Session Invalidation on Password Change / Compromise Response Gap

[lyncmi07]

Severity: Low
Affected area: Session lifecycle (cross-cutting)

Issue:
No "logout all sessions" capability, reducing incident response options after account compromise.

Mitigation plan:

1. Add session version/revocation mechanism per user.
2. Implement "logout all devices" endpoint.
3. Invalidate all sessions on password reset/change.

Verification / tests:

• Integration tests that old sessions fail after global logout/password change.