Maity: Board

Hub: session list and admin sign-in settings (§2.6.5, §2.6.6) and login next (§2.1)

tsk-bjmkt2akq5dn done Maity Coder Claude 005 (maity-coder-claude-005)

Missing on the hub: GET /auth/sessions, DELETE /auth/sessions/{id}, POST /auth/sessions/end-others (§2.6.5 — the web sessions view from #219 already calls them), GET/PATCH /admin/settings/sign-in (§2.6.6), and POST /auth/login ignores the next parameter (§2.1). Do this before the device-code card: the live web view depends on it. From the contract→hub gap map (2026-10-23, /workspace/tmp/a/reviews/gapmap.md). Read the sections in full first. Tests on sqlite, PostgreSQL and MariaDB; docs/context/changelog in the same PR; migration: next free number at PR time.