Expand cascade-revoke and replay-window coverage for companion sessions

[SiteRelEnby]

The first watchOS-refresh-token PR shipped with coverage of the basics (mint, /logout cascade, solo revoke, change-password carve-out) but missed several paths that the cascade contract has to honour, and a report came back that paired devices still see refresh-related logouts. Filling the obvious gaps so a backend regression here can't slip past again:

• /sessions/{id} DELETE — same cascade as /logout, but a different code path. Without it a fix to one path could regress the other silently.
• /sessions/revoke-others — children of the calling session must survive, children of revoked siblings must not. Previously only the keep-the-watch half was covered.
• Grandchild cascade — the contract is recursive even though no feature mints grandchildren today; future work will rely on it.
• Multiple children of one parent all cascade.
• Concurrent /refresh on a child token — the replay-window grace that protects the phone has to apply to the watch too, otherwise parallel refresh-rotation races on the watch nuke the session.
• Mint after parent session revoked — must 401, otherwise a stolen access token outliving its session could spawn fresh refresh JWTs indefinitely.

All ten companion-session tests pass; full main-config suite remains green at 254 passed.