v0.87.2 — revoke on member credential writes

A member's password reset no longer leaves their other sessions alive.

The security stamp on account_members invalidated MEMBER sessions, and that was the whole of log-out-everywhere while a member session existed. It is a host's decision to stop keeping one — the credential of record is the subject, so a second session for the same person is a second place to ask who they are — and the moment a host makes that decision, the control silently stops covering anything: Subjects::setPassword() does not revoke.

resetPassword() now revokes the subject's sessions inside its existing transaction. The stamp still moves; its other job, making a reset link single-use, is a different question and is unchanged.

activate() revokes too. Removing a member deactivates their subject without revoking its sessions, so accepting a later invitation resurrected the old ones beside a freshly-replaced password.

Falsified both ways: deleting either revocation turns its test red.