List signed-in devices

Every browser, mobile app and terminal signed in to the account, the caller's own session first (current). Each sign-in opens its own session, so signing in on a new device never signs another one out. Location is where the device signed in from (country and city from its IP), absent when unknown. API keys are not sessions: list them with GET /api/tokens.