fix(backend): make access tokens revocable via session validation

The auth middleware trusted any unexpired, well-signed access token, so
logout, session termination and admin blocks had no effect until the
15-minute token expired. The middleware now validates that the token's
session is still active on every request (SessionRepo.GetByID), and
blocking a user deactivates all of their sessions, immediately revoking
their outstanding access tokens.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/internal/integration/server_test.go

@@ -131,7 +131,7 @@ func setupSuite(t *testing.T) *harness {
 	categorySvc := service.NewCategoryService(categoryRepo, tagRepo, aclSvc, auditSvc)
 	poolSvc     := service.NewPoolService(poolRepo, aclSvc, auditSvc)
 	fileSvc     := service.NewFileService(fileRepo, mimeRepo, diskStorage, aclSvc, auditSvc, tagSvc, transactor, filesDir)
-	userSvc     := service.NewUserService(userRepo, auditSvc)
+	userSvc     := service.NewUserService(userRepo, sessionRepo, auditSvc)
 
 	// Bootstrap the admin account the suite logs in with (replaces the old
 	// hardcoded seed credentials).