feat(session): add session list API

- Move token-related functions from auth.go to new session.go
- Add session tracking with expiration and cleanup
- Implement session list API endpoint
- Update login/logout handlers to use session system
- Add hourly cleanup of expired tokens and sessions

handlers.go

@@ -166,4 +166,4 @@ func LogRequest(r *http.Request, userID int) {
 
 func IntToString(i int) string {
 	return strconv.Itoa(i)
-}
+}