Logout All Devices

退出当前账号在所有设备上的登录，返回一张给当前设备用的新 JWT。

Tokens live 30 days and cannot be revoked individually (no server-side session store), so this is the escape hatch for "I left myself signed in somewhere". Deliberately requires no password: someone who wants to secure a session they can no longer reach should not have to stop and remember a password first — and holding a valid token already proves as much as the password would.

The current device is not logged out: it swaps in the returned token.