feat: implement ActiveSessions component and JWT session tracking to manage user device access

libs/auth/src/lib/utils/jwt.ts

@@ -0,0 +1,18 @@
+/**
+ * Session id from the access token, when it carries one.
+ *
+ * `/sessions/my-sessions` returns no "this is you" flag, so the only way to
+ * stop the user revoking the session they are sitting in is to read the id off
+ * the token. Undefined is a normal answer — an opaque token just means no
+ * "This device" badge and a confirm dialog that warns instead.
+ */
+export function currentSessionId(token?: string): string | undefined {
+  const payload = token?.split('.')[1];
+  if (!payload) return undefined;
+  try {
+    const claims = JSON.parse(atob(payload.replace(/-/g, '+').replace(/_/g, '/')));
+    return claims.sessionId ?? claims.sid ?? claims.jti;
+  } catch {
+    return undefined;
+  }
+}