feat: sessions management, web manifest, square icon-only buttons, remove lang select

- Backend: migration 002 adds user_agent/ip/last_used_at to refresh_tokens
- Backend: GET /api/auth/sessions + DELETE /api/auth/sessions/{id} endpoints
- Frontend: profile page — sessions section (browser, IP, datetime, revoke)
- Frontend: web manifest + SVG icon for PWA support
- Frontend: remove language selector from all navbars (moved to profile page)
- Frontend: neu-btn--icon-sm class for square icon-only buttons (theme/logout/edit)
- Frontend: manifest link added to all 9 HTML pages

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/login.html

@@ -10,6 +10,7 @@
   <link rel="stylesheet" href="/css/light.css" />
   <link rel="stylesheet" href="/css/pages.css" />
   <link rel="stylesheet" href="/css/lineicons-duotone.css" />
+  <link rel="manifest" href="/manifest.json" />
   <script src="/js/vendors/htmx.min.js"></script>
   <script src="/js/vendors/swup.iife.js"></script>
   <script src="/js/app.js"></script>