Revoke All Sessions

Security hardening item 1 (23 Sep 2026) -- 'log out all devices'. Bumps token_version so every access token issued before this moment (across every browser/device) now fails the tv check in get_current_user, regardless of its remaining expiry. Coarse (all-or-nothing), not per-device selective revocation -- that would need a real per-token session table, a bigger build than what this backlog item asked for.

Includes the CALLING device's own current token -- the frontend must clear local storage and redirect to login right after this call returns, not expect to remain signed in, since this request's own token becomes invalid the instant the commit below lands.