[augustuswm]

Adds two new endpoints:

• List sessions for a user. This list includes expired sessions.

/// List existing sessions for a user.
#[endpoint {
    method = GET,
    path = "/api-user/{user_id}/session",
}]

• Log out user. This marks all non-revoked sessions for a user as revoked.

/// Revoke all sessions for a user.
///
/// Returns an empty response on success.
#[endpoint {
    method = POST,
    path = "/api-user/{user_id}/logout",
}]

[notpeter]

Would love to see a test for the two new functions (list/revoke).
But otherwise looks good.

[notpeter]

Do we want to support users logging themselves out or only admins?

[augustuswm]

Eventually yes, but didn't want to hold this up on determining the required permission for it.