feat: 会话管理 - 支持按设备粒度踢下线

- 新增 sessions 表，每次登录创建会话记录（记录 IP/UA）
- AuthMiddleware 改为基于 session 校验，可精确踢掉单个设备
- 自己改密码后踢掉其他设备，管理员改密码后踢掉该用户全部设备
- 新增 GET /api/me/sessions 查看活跃会话列表
- 新增 DELETE /api/me/sessions/:sessionId 踢掉指定会话
- 新增 DELETE /api/admin/users/:id/sessions 管理员强制下线某用户
- 兼容无 session_id 的旧 token，回退到 TokenInvalidBefore 校验

internal/middleware/auth.go

@@ -5,6 +5,9 @@ import (
 	"strings"
 	"time"
 
+	"lmvpn/internal/db"
+	"lmvpn/internal/model"
+
 	"github.com/gin-gonic/gin"
 	"github.com/golang-jwt/jwt/v5"
 )
@@ -15,17 +18,19 @@ const (
 )
 
 type Claims struct {
-	UserID   uint   `json:"user_id"`
-	Username string `json:"username"`
-	Role     string `json:"role"`
+	SessionID string `json:"session_id,omitempty"`
+	UserID    uint   `json:"user_id"`
+	Username  string `json:"username"`
+	Role      string `json:"role"`
 	jwt.RegisteredClaims
 }
 
-func GenerateToken(userID uint, username, role string) (string, error) {
+func GenerateToken(sessionID string, userID uint, username, role string) (string, error) {
 	claims := Claims{
-		UserID:   userID,
-		Username: username,
-		Role:     role,
+		SessionID: sessionID,
+		UserID:    userID,
+		Username:  username,
+		Role:      role,
 		RegisteredClaims: jwt.RegisteredClaims{
 			ExpiresAt: jwt.NewNumericDate(time.Now().Add(tokenExpire)),
 			IssuedAt:  jwt.NewNumericDate(time.Now()),
@@ -86,9 +91,48 @@ func AuthMiddleware() gin.HandlerFunc {
 			return
 		}
 
+		var user model.User
+		if err := db.DB.First(&user, claims.UserID).Error; err != nil {
+			c.JSON(http.StatusUnauthorized, gin.H{"error": "用户不存在"})
+			c.Abort()
+			return
+		}
+
+		if user.Status != 1 {
+			c.JSON(http.StatusForbidden, gin.H{"error": "账号已被禁用"})
+			c.Abort()
+			return
+		}
+
+		if claims.SessionID != "" {
+			var session model.Session
+			if err := db.DB.Where("session_id = ?", claims.SessionID).First(&session).Error; err != nil {
+				c.JSON(http.StatusUnauthorized, gin.H{"error": "会话不存在"})
+				c.Abort()
+				return
+			}
+			if session.Invalid {
+				c.JSON(http.StatusUnauthorized, gin.H{"error": "会话已失效，请重新登录"})
+				c.Abort()
+				return
+			}
+			if time.Now().After(session.ExpiresAt) {
+				c.JSON(http.StatusUnauthorized, gin.H{"error": "会话已过期，请重新登录"})
+				c.Abort()
+				return
+			}
+		} else if user.TokenInvalidBefore != nil && claims.IssuedAt != nil {
+			if claims.IssuedAt.Time.Before(*user.TokenInvalidBefore) {
+				c.JSON(http.StatusUnauthorized, gin.H{"error": "令牌已失效，请重新登录"})
+				c.Abort()
+				return
+			}
+		}
+
 		c.Set("user_id", claims.UserID)
 		c.Set("username", claims.Username)
 		c.Set("role", claims.Role)
+		c.Set("session_id", claims.SessionID)
 		c.Next()
 	}
 }