[everpcpc]

Goal

Clean up the admin navigation and make sessions manageable:

• the sidebar grouping had some friction: a Server entry nested inside a Server group, Account stranded below the admin section, and a whole page for two login toggles
• the sessions panel on the server status page listed anonymous session ids with no owner and nothing to act on

Changes

Sidebar and pages (webui)

• Admin section order is now Import → Maintenance → Server; Account sits above the admin section.
• The nested Server → Server entry is renamed to Status (route /admin/server unchanged); the page title and the import page's "Server page" link copy follow, in all 10 locales.
• UI settings merged into the top of the settings page as the Login section; /admin/ui redirects to /admin/settings and its nav entry is removed.

Session management (backend + webui)

Modeled on authentication activity — one view for users, one for admins:

• GET /api/v2/users/me/sessions — the caller's sessions, with current marking the session the request authenticated with. DELETE /api/v2/users/me/sessions/{id} revokes one; sessions belonging to someone else read as 404.
• GET /api/v2/users/sessions (admin) — every live session with its owner (userId, email), most recently active first. DELETE /api/v2/users/sessions/{id} kicks one.
• Auth now carries the caller's session id so endpoints can flag current.
• Account → Security lists the user's sessions between password and login activity, with the current session marked. Admin → Users lists all sessions above authentication activity, with the owner on every row and a kick action.
• The kmrs-private GET/DELETE /api/v1/server/sessions endpoints are removed (the Java version has no such surface; the webui was their only consumer), and the server status page drops its sessions panel.

Testing

• cargo fmt --all -- --check, cargo clippy --workspace --all-targets -- -D warnings, cargo nextest run --workspace all green — including new endpoint tests covering self scoping, the current flag, the admin owner column, kick, and the 401/403/404 paths.
• webui pnpm build and pnpm lint green.
• Browser smoke against a local instance (zh-Hans and en): sidebar order, the Status rename, both session sections render correctly, a kicked session's cookie immediately gets 401, the settings page shows the Login section on top, and /admin/ui redirects.

Docs: kmworks/website#69 adds the matching session-management enhancements page.