Login security

[ArtyomSavchenko]

Account security: login history, active sessions & token rotation

Builds on the login-security branch: adds a Login history / Active sessions UI,
durable sessions with per-session revocation, and short-lived access tokens with
rotating refresh tokens.

Highlights

• Login history & Active sessions — the Security settings split into two views.
  Login history shows only real logins/logouts (server-side eventType filtering;
  workspace-switch session churn hidden). Active sessions lists the user's
  sessions with a "This device" badge and a Sign out (revoke) action.
• Per-session revocation — new durable ActiveSession record (Postgres + Mongo)
  tied to a sessionId token claim. Checked at connect (getLoginWithWorkspaceInfo)
  and pushed to transactors over Kafka (SessionRevoked → closeSessionByLoginId)
  for immediate live-socket teardown.
• Token rotation — access tokens get kind:'access' + short exp; a rotating
  refresh token (kind:'refresh') is exchanged at a new refreshToken endpoint with
  reuse detection (replaying an old generation revokes the session). The refresh
  token lives in an httpOnly cookie set by the account service; the front runs a
  single-flight, cross-tab refresh loop.
• Ops — session GC (purgeRevokedActiveSessions), reuse observability
  (session_revoked_reuse events + warn logs).

Config / rollout

• ACCESS_TOKEN_TTL_SEC (default 0 = off), REFRESH_TOKEN_TTL_SEC (default 30d),
  ACTIVE_SESSION_RETENTION_DAYS (default 30).
• Access-token expiry is off by default — enable per the runbook in
  docs/token-rotation-plan.md after validating the front refresh loop in a real
  build. Keep ACCESS_TOKEN_TTL_SEC well above the transactor reconnect window.
• Adds @hcengineering/kafka to pods/account → run rush update.

Testing

• tsc clean (token, account-client, account, account-service, transactor);
  svelte-check clean for the touched plugins.
• Unit tests for session lifecycle, revocation, refresh rotation & reuse detection,
  eventType classification, and session GC.
• Runtime validation of the front rotation + cookie round-trip is pending a full
  build (see runbook).