Token of other device is not expired after password changed

1. Set initializer config `remove_tokens_after_password_reset` to true
2. If we look that the method. It explain we are removing all tokens except the latest token.
https://github.com/lynndylanhurley/devise_token_auth/blob/8f44a8c66fd772b2d33be4ba187c0b1a47caba2a/app/models/devise_token_auth/concerns/user.rb#L246-L253

3. If other device login later than our current client, his token is not expired and he still be able to access the application
4. The behavior should be expire all the tokens except current client token.

Start with app/models/devise_token_auth/concerns/user.rb at lines 246-253 and reproduce the two-device scenario with remove_tokens_after_password_reset enabled. Verify which token is treated as current after the password change, then add coverage showing that the other device's token is expired while the current client token remains usable.

Written by the indexing model from the issue text.