[Security][High] Add revocable sessions and invalidate authorization changes immediately

[BechsteinDigital]

Severity

High

Problem

JWTs carry role and permission claims for up to one hour without a jti, security stamp, token version or server-side session record. Password changes, role removal, logout and user deletion therefore do not invalidate an already issued token. Claims transformation only adds current data; it does not reject deleted/deactivated users or remove stale claims.

Evidence

• src/Core/Infrastructure/Security/BackendJwtTokenIssuer.cs:62
• src/Core/Infrastructure/Security/BackendClaimsTransformation.cs:23
• src/Core/Infrastructure/Security/BackendAuthCookieService.cs:29

Acceptance criteria

• Sessions carry a revocable identifier or account token version.
• Password changes, account deletion/deactivation and RBAC changes revoke existing sessions.
• Logout invalidates the server-side session, not only the browser cookie.
• Requests from deleted or disabled users are rejected.
• Tests cover stolen-token use after each revocation event.
• Revocation lookup is bounded and suitable for the request hot path.