enhance: add session manager to view and revoke active sessions

[a1012112796]

Users can now view and revoke their active sessions from a new "Active Sessions" page under user settings. Sign-ins record the client IP, user agent, sign-in time and method, and sessions are indexed by user ID. The feature is off by default behind ENABLE_SESSION_MANAGER.

example view:

blocked by: https://gitea.com/go-chi/session/pulls/13

Assisted-by: GitHub Copilot:DeepSeek V4 Pro

[wxiaoguang]

I don't see how it address the "remember me" problem: how to make a user logout from its "remember me" sign-in.

Even the "remember me" is not strictly a "web browser session", it is still a kind of "user's login session".

[a1012112796]

I don't see how it address the "remember me" problem: how to make a user logout from its "remember me" sign-in.

Even the "remember me" is not strictly a "web browser session", it is still a kind of "user's login session".

Now I store the "Remember me" token id in session when autoSigin (maybe need update too store it in sigin with creating token aslo)

then, when revoke session, will delete it also. In my local test, it works.

In gitlab, Looks it will delete all token, wonder whether it's a better option or not.

https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/profile/active_sessions.md#revoke-a-session