feat: sessions management, web manifest, square icon-only buttons, remove lang select

- Backend: migration 002 adds user_agent/ip/last_used_at to refresh_tokens
- Backend: GET /api/auth/sessions + DELETE /api/auth/sessions/{id} endpoints
- Frontend: profile page — sessions section (browser, IP, datetime, revoke)
- Frontend: web manifest + SVG icon for PWA support
- Frontend: remove language selector from all navbars (moved to profile page)
- Frontend: neu-btn--icon-sm class for square icon-only buttons (theme/logout/edit)
- Frontend: manifest link added to all 9 HTML pages

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/build.mjs

@@ -93,4 +93,19 @@ for (const f of fs.readdirSync('.')) {
   }
 }
 
+// 8. Copy manifest.json
+if (fs.existsSync('manifest.json')) {
+  fs.copyFileSync('manifest.json', `${dist}/manifest.json`)
+  console.log('Copied manifest.json')
+}
+
+// 9. Copy icons/
+if (fs.existsSync('icons')) {
+  fs.mkdirSync(`${dist}/icons`, { recursive: true })
+  for (const f of fs.readdirSync('icons')) {
+    fs.copyFileSync(`icons/${f}`, `${dist}/icons/${f}`)
+  }
+  console.log('Copied icons/')
+}
+
 console.log('✓ Build complete → dist/')