feat(auth): add session history retention and lifecycle updates

- Add daily session history cleanup with a 180-day retention period
- Run cleanup on startup and every 24 hours in batches of up to 1,000 sessions
- Add tests for session retention and derived session status
- Allow viewers to manage their own sessions while preserving global access for super admins
- Prevent the current browser session from being revoked through session management
- Derive active, expired, and revoked status without writing during list requests
- Count only active sessions toward the 20-session per-user limit
- Remove unused session event queries and payloads from the session listing endpoint
- Update the session management UI for the revised access and revocation policies

.env.docker

@@ -27,6 +27,9 @@ DATABASE_URL=postgresql://doktainer:doktainerdb@postgres:5432/doktainer?schema=p
 # /* ------------------------------- App server ------------------------------ */
 NODE_ENV=production
 
+# Browser authentication in this production configuration requires HTTPS.
+# Plain HTTP remains supported only by the local development configuration.
+
 # Bind address for the backend process inside the container.
 # This is NOT a public URL and must not be reused as FRONTEND_URL or NEXT_PUBLIC_PANEL_URL.
 HOST=0.0.0.0
@@ -66,7 +69,7 @@ ENCRYPTION_KEY=dev-32-char-encryption-key-here!
 # Optional comma-separated extra origins when the backend is exposed directly and CORS must allow them.
 # Keep this explicit for security; this is not auto-derived from request origin.
 
-# CORS_ORIGINS=https://panel.example.com,http://your-vps-ip:3128
+# CORS_ORIGINS=https://panel.example.com
 
 # Optional internal backend URL used by Next rewrites in monolith mode.
 # This is internal-only and separate from the public panel URL above.