Invalidate sessions when privileges change

When you promote, demote, or revoke a user's roles, existing sessions often keep the previous permissions until they expire. That gap is a common auth bug: the admin panel shows the new role, while th