Sprint 002: refresh-token rotation and stored sessions

[pkeen]

Summary

• fe9fe82 Sprint 002: opt-in refresh-token rotation with stored sessions (core ports, in-memory and Postgres repositories, migration 0002_sessions), reuse detection, per-device sign-out, sign out everywhere, claim ver 2 with sid, demo proxy renewal, refresh route and devices page. ADR-004 added. Behaviour with refresh disabled is unchanged.
• 608b958 Tighten the refresh grace window from 30 s to 10 s, and cap access tokens issued inside it at 120 s, to limit what an undetected replay of a just-replaced token can obtain. ADR-004 and the session policies guide are updated, with a new test for the cap.

Verification

Run locally on this branch: core 257 tests, demo app 171 tests, drizzle adapter 35 Postgres integration tests (Docker Postgres), tsc --noEmit clean in core and the demo app, package builds pass. Not run: ESLint (pre-existing plugin crash), and no live-provider check of the tightened window; the Sprint 002 live check was done before the change. The sprint brief's delivery record still says 30 s as history; ADR-004 records the revision.