fix(security): SUM-SEC-01 — reject deactivated users at session resolve

[ATRIwOX]

Summary

• Fix SUM-SEC-01: resolveSession JOINs sys.session with core.user and requires active = true; on failure deletes the session row, clears sumeru_session, and returns uid 0
• Middleware clears the cookie when a session is invalidated; RPC returns 401 for deactivated cookie sessions
• SUM-SEC-02 (partial): SetUserPasswordHash calls DestroySessionsForUser to revoke all DB sessions on password change
• Harden session lifetime: browser-scoped session cookie, 24h DB ceiling, 8h idle slide; last-tab sendBeacon logout
• Consolidate auth into auth.go + login.go; remove auth_session.go

Test plan

• go test ./test/core/server/web/... -count=1
• SUMERU_TEST_DSN='...' go test -tags integration ./test/core/server/web/... -run 'TestInactive|TestPassword|TestResolve' -v
• Manual: log in → admin sets core.user.active = false → next /web request redirects to login; /api/rpc returns 401; cookie cleared
• Manual: password change removes all sys.session rows for that user
• Manual: closing last Sumeru tab triggers logout beacon