Fix reported gameplay and account issues

[vtm9]

Summary

• introduce revocable user_sessions for every login path, including dev login, with an active-devices UI in Settings
• require existing legacy sessions to sign in again and bind authenticated WebSockets to a concrete user session
• add password changes with current-password verification, rate limiting, token rotation, revocation of other devices, and WebSocket disconnects
• fix task-launched authenticated games, waiting-game redirects, stale invites, tournament schedule membership, localized task names, language icons, settings translations, and sound saving
• harden task-pack ID parsing so malformed, non-string, oversized, and out-of-range payloads return validation errors instead of 500 responses
• add regression coverage for game recovery, settings, sessions, dev login, invites, schedules, task packs, and related authentication paths
• document make test, mix credo --strict, and mix dialyzer as final repository verification commands

Security

• session credentials use 256-bit random tokens; only SHA-256 token hashes are stored in PostgreSQL
• raw session tokens stay in signed HTTP-only session cookies
• session records are user-owned, expiring, independently revocable devices
• legacy user-id-only HTTP sessions and legacy integer WebSocket tokens are rejected
• changing a password rotates the current credential and revokes/disconnects every other device
• password changes require the current password, enforce bcrypt's 72-byte limit, and are rate-limited
• session deletion is scoped by both current user ID and session UUID

Verification

• make test — passed
• mix credo --strict — no issues
• mix dialyzer — 0 errors
• frontend Vitest — 25 files, 95 tests passed
• tsc --noEmit — passed
• OX lint and formatting checks for changed frontend files — passed

Fixes #2328
Fixes #2325
Fixes #2324
Fixes #2323
Fixes #2319
Fixes #2318
Fixes #2317
Fixes #2316
Fixes #2315
Fixes #2314
Fixes #1321
Fixes #1646