invalidate other sessions on password change

[fabracht]

Summary

• Adds SessionStore::destroy_others_by_canonical_id(canonical_id, keep_session_id) -> Vec<String> returning JWTs of removed sessions so callers can revoke their JTIs.
• POST /auth/password/change now keeps the caller's session and destroys every other session for the same canonical_id. JTIs from those JWTs are added to JtiRevocationStore.
• POST /auth/password/reset/submit destroys all sessions for the target user (no current session at reset time) and revokes their JTIs.
• MQTT password-change path ($DB/_auth/password/change) is intentionally out of scope — AdminContext has no reference to SessionStore, and threading it through is plumbing for a separate PR.

Closes #37 (HTTP scope); MQTT path tracked as follow-up.

Test plan

• cargo make dev (format + clippy + 750 tests)
• 3 new unit tests in session_store.rs for the new method (keep-current-session / destroy-all / unknown-user)