feat(session): add session removal endpoint and refactor session management

- Implement new `/sessionMgr/remove` endpoint for superusers to remove sessions
- Refactor session and token management to use sessionTokenMap for better tracking
- Update session cleanup logic to handle both tokens and sessions
- Add documentation for new API endpoint in docs/api.md
- Modify logout handler to use new session removal approach

docs/api.md

@@ -299,6 +299,48 @@ X-Timestamp: 1704067200000
 
 ---
 
+## Remove Session
+
+**Endpoint**: `/sessionMgr/remove`  
+**Method**: POST  
+**Content-Type**: application/json  
+**Auth Required**: Yes (token)  
+**Permission Level**: Superuser
+
+**Request Headers**:
+```
+X-Token: your_token
+X-Timestamp: 1704067200000
+```
+
+**Request Body**:
+```json
+{
+  "sessionID": "session-5f4dcc3b5aa765d61d8327deb882cf99-1704067200000"
+}
+```
+
+| Header | Type | Required | Description |
+|--------|------|----------|-------------|
+| X-Token | string | Yes | Authentication token |
+| X-Timestamp | int64 | Yes | Client timestamp in milliseconds |
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| sessionID | string | Yes | Session ID to remove |
+
+**Response**:
+```json
+{
+  "success": true,
+  "message": "Session removed successfully"
+}
+```
+
+> **Note**: This endpoint requires superuser permission. It removes a session by its sessionID and also removes the associated token, forcing the user to re-login.
+
+---
+
 ## Create frpc Instance
 
 **Endpoint:** `/frpcAct/instanceMgr/create`