v0.1.3

Added

• Stranded-device visibility. A device still presenting a revoked,
  expired, or deactivated-account bearer token used to fail with silent 401s;
  those rejections now appear as token_rejected events in the admin
  auth-activity feed. Expired/inactive rejections name the user and token
  ("alice's token 'iPhone' rejected — expired"); unknown tokens can't be
  attributed and show a short token fingerprint instead, so repeats are
  recognizable. Events are throttled per device (per source IP for unknown
  tokens) to at most one per 6 hours, so a retrying device or a scanner can't
  flood the feed.

Full changelog: CHANGELOG.md