fix(api): compute device online status in session queries

[luizhf42]

What

Device online status in session list and session resolve responses now reflects actual connectivity instead of always returning false.

Why

Device.Online is a computed scanonly field that defaults to Go's zero value (false) when not explicitly calculated. DeviceList and DeviceResolve compute it via a SQL CASE expression, but SessionList and SessionResolve load devices through bun's Relation("Device") which never includes that expression — so every session response reported the device as offline regardless of actual state.

Changes

• api/store/pg/device.go: exported DeviceOnlineThreshold and DeviceIsOnline — a Go-side equivalent of the existing deviceExprOnline SQL expression, reusable by both core and cloud store layers
• api/store/pg/session.go: SessionList and SessionResolve now compute Device.Online after loading entities, using the same disconnected_at + last_seen logic as device queries

Testing

1. Start the dev environment and connect a device
2. Open an SSH session to the device
3. GET /api/sessions — verify device.online is true for the connected device
4. Disconnect the device, wait >2 minutes, refresh — verify it flips to false

[github-actions]

Claude finished @luizhf42's task in 53s —— View job

---

Code Review Complete

Reviewed 4 files across code quality, security, testing, Go/TypeScript patterns, and architecture — no issues found. The code looks good as-is.

The fix correctly mirrors the existing deviceExprOnline SQL logic in Go, with proper nil guards on Device and consistent use of clock.Now() for testability. The cloud store layer at cloud/pkg/store/pg/session.go already consumes the new exports (DeviceIsOnline, DeviceOnlineThreshold) consistently.

---

If you push additional changes and want a new review, tag @shellhub-io/admin and a team member can trigger it.