feat(auth): add POST /auth/logout-all to end every session

[nicolasgutierrezdev]

Summary

Users could only end their current session (POST /api/v1/auth/logout). After a suspected compromise there was no way to kill sessions on other devices, including ones they no longer control. crudauth 0.6 already has the primitive (revoke_all / terminate_all_user_sessions) and its own /logout-all route, but the boilerplate mounts its own auth router, so that route was never exposed.

Behavior

Call	Sessions ended	This client's cookies
POST /logout-all	all of the user's sessions, including this one	cleared
POST /logout-all?keep_current=true	every session except this one	kept

Response: {"message": ..., "terminated_count": n}.

• Requires a valid session plus the CSRF header, same as /logout (401 / 403 otherwise).
• Rate limited per user via crudauth's logout_all default (10/hour).
• No sudo or re-auth step: this is the action you reach for when you can't trust your current session.

Verified against Redis (docker stack)

Step	Result
3 devices log in	session_users:1 holds 3
B: ?keep_current=true	terminated_count: 2, A and C logged out, B still logged in, 1 key left
D logs in, B: logout-all	terminated_count: 2, B and D logged out, cookie cleared, 0 session:* keys
Rate limit headers	x-ratelimit-limit: 10, remaining 9 → 8
No CSRF / no session	403 / 401

Changes

• src/infrastructure/auth/routes.py: POST /logout-all with keep_current
• tests/integration/auth/test_endpoints.py: all sessions ended, keep_current keeps the calling session, 401 without a session, 403 without CSRF. Each test first clears the user's leftover sessions, because the in-memory store is shared across the test run and every test's test_user gets the same id.
• Docs (authentication/sessions.md, api/index.md, project-structure.md): new "Logout All Sessions" section with curl examples; route lists updated