fix(files): ending every session and making a token lock the user without holding up rows that refer to it

backend/app/routes/auth.py

@@ -1150,12 +1150,14 @@ def bump_session_epoch(db: Session, user: User) -> None:
     outlive the answer to that theft. Not committed — the caller commits it with its change.
 
     The user's row is locked before the tokens go, the lock `create_token` takes too: a token made at
-    the same moment either commits first and is deleted here, or waits and sees the new epoch."""
+    the same moment either commits first and is deleted here, or waits and sees the new epoch. FOR NO
+    KEY UPDATE (`key_share`): the two still exclude each other, but a row that only refers to the user
+    (a notice, an audit line) is not held up — a token's expiry notice would deadlock with it."""
     if user.id is None:
         user.session_epoch = (user.session_epoch or 0) + 1
         return
     epoch = db.execute(
-        select(User.session_epoch).where(User.id == user.id).with_for_update()
+        select(User.session_epoch).where(User.id == user.id).with_for_update(key_share=True)
     ).scalar_one()
     user.session_epoch = (epoch or 0) + 1
     apitokens.revoke_all(db, user.id)