security: revoke sessions on self-service password reset

[lakhansamani]

The gap

The self-service password reset flow (internal/service/reset_password.go) updated the user's password but never revoked their existing sessions or refresh tokens. Anyone holding a live session before the reset (e.g. the attacker whose access you're resetting the password to kill) kept full access afterward — the reset was cosmetic against a live intruder (CWE-613: Insufficient Session Expiration).

Two sibling flows already do the right thing on a similar sensitive change:

• internal/service/update_profile.go (on email change)
• internal/service/deactivate_account.go

Both call MemoryStoreProvider.DeleteAllUserSessions(user.ID). Password reset was the odd one out.

The fix

Add the same DeleteAllUserSessions call after the password update succeeds, matching the existing pattern exactly — fire-and-forget in a goroutine, so a memory-store hiccup logs and continues rather than failing the reset:

go func() { _ = p.MemoryStoreProvider.DeleteAllUserSessions(user.ID) }()

This covers both token and OTP reset paths (single shared code path in ResetPassword).

Test

Extended TestResetPassword with should revoke existing sessions after reset:

1. Sign up + log in (mints a session and an offline_access refresh token).
2. Reset the password via the forgot-password verification token.
3. Assert the user's sessions are gone from the memory store, then assert the pre-existing refresh token is rejected (401) by /oauth/token.

The test discriminates: it fails on main (session survives) and passes with the fix. Refresh tokens are single-use (rotated on success), so the test polls the non-mutating memory store to detect revocation rather than polling the refresh endpoint (which would self-invalidate the token and mask the bug).

make test-sqlite passes clean.