feat(07.1): session revocation on privilege change — CR-01/CR-02/CR-03

- revoke_all_refresh_tokens: add skip_token_hash optional param (exclude
  current session while revoking others)
- change_password, enable_totp, disable_totp: call revoke with skip hash
  derived from refresh cookie; return sessions_revoked in response and
  write to audit log metadata_
- 3 new tests: test_{change_password,enable_totp,disable_totp}_revokes_other_sessions
  — all PASSED; 373 total passing, 0 regressions
- Frontend toasts: SettingsAccountTab + TotpEnrollment show
  "Other sessions have been terminated." when sessions_revoked > 0
- Companion fixes: rate_limiting get_client_ip refactor, deps/auth.py
  request.state.current_user, locustfile refresh-token task removal
- Version bump: 0.1.0 → 0.1.1

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/components/settings/SettingsAccountTab.vue

@@ -1,6 +1,29 @@
 <template>
   <div class="space-y-6">
 
+    <!-- Sessions-revoked toast (fixed top-right, auto-dismisses after 5s) -->
+    <div
+      v-if="sessionRevokedToast"
+      class="fixed top-4 right-4 z-50 flex items-center gap-3 bg-white border border-green-200 rounded-xl shadow-lg px-5 py-4 max-w-sm"
+    >
+      <svg class="w-5 h-5 text-green-500 shrink-0" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
+          d="M9 12l2 2 4-4m6 2a9 9 0 11-18 0 9 9 0 0118 0z" />
+      </svg>
+      <div class="flex-1 min-w-0">
+        <p class="text-sm font-semibold text-gray-900">Other sessions have been terminated.</p>
+      </div>
+      <button
+        @click="sessionRevokedToast = false"
+        aria-label="Dismiss notification"
+        class="text-gray-400 hover:text-gray-600 shrink-0"
+      >
+        <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+          <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12" />
+        </svg>
+      </button>
+    </div>
+
     <!-- 1. Account information -->
     <section class="bg-white border border-gray-200 rounded-xl p-6">
       <h3 class="font-semibold text-gray-800 mb-4">Account information</h3>
@@ -185,19 +208,24 @@ const newPassword = ref('')
 const changingPassword = ref(false)
 const passwordError = ref(null)
 const passwordSuccess = ref(null)
+const sessionRevokedToast = ref(false)
 
 async function changePassword() {
   changingPassword.value = true
   passwordError.value = null
   passwordSuccess.value = null
   try {
-    await api.changePassword({
+    const data = await api.changePassword({
       current_password: currentPassword.value,
       new_password: newPassword.value,
     })
     passwordSuccess.value = 'Password updated.'
     currentPassword.value = ''
     newPassword.value = ''
+    if (data.sessions_revoked > 0) {
+      sessionRevokedToast.value = true
+      setTimeout(() => { sessionRevokedToast.value = false }, 5000)
+    }
   } catch (e) {
     const msg = e.message || ''
     if (msg.toLowerCase().includes('current') || msg.toLowerCase().includes('incorrect')) {
@@ -226,11 +254,15 @@ function onTotpEnrolled() {
 async function disableTotp() {
   totpError.value = null
   try {
-    await api.totpDisable()
+    const data = await api.totpDisable()
     if (authStore.user) {
       authStore.user.totp_enabled = false
     }
     confirmDisable2fa.value = false
+    if (data.sessions_revoked > 0) {
+      sessionRevokedToast.value = true
+      setTimeout(() => { sessionRevokedToast.value = false }, 5000)
+    }
   } catch (e) {
     totpError.value = e.message
   }