Session management and account security UI

## Summary
Implement session management and account security UI with the core controls users expect from a modern chat app.

## Scope
- Show active sessions and allow users to revoke them.
- Support password change and other core account-security actions.
- Surface meaningful login/session metadata such as last seen, device, or IP where appropriate.
- Keep banned, revoked, and expired session behavior coherent.

## Acceptance Criteria
- [ ] Users can review and revoke active sessions from the product UI.
- [ ] Users can change security-sensitive account settings without leaving the app.
- [ ] Session metadata shown to users is accurate enough to support trust decisions.
- [ ] Revoked or expired sessions are disconnected and prevented from silently continuing.

## Operational Notes
- Security UI must be grounded in the actual session model already used by the app.
- Self-hosted deployments should avoid implying protections that do not really exist.

No files or tests are named. Start by locating the existing session model and account-settings UI, then verify how banned, revoked, and expired sessions behave; done means the product UI supports reviewing and revoking sessions, changing security settings, showing accurate metadata, and preventing revoked or expired sessions from continuing.

Written by the indexing model from the issue text.