fix(files): the token list is fresh after the sessions end, a copy again reads Copied again, the Copied button says so

frontend/src/components/SettingsPanel.tsx

@@ -361,7 +361,7 @@ function AccessRow({
 // so either method can reach the same account. Google connect is a full-page OAuth round-trip
 // (auth.py attaches the identity to the current session via /auth/link); the password form posts
 // directly with inline errors.
-function SignInMethods({ me }: { me: Me }) {
+export function SignInMethods({ me }: { me: Me }) {
   const { t } = useTranslation();
   const qc = useQueryClient();
   const confirm = useConfirm();
@@ -387,6 +387,8 @@ function SignInMethods({ me }: { me: Me }) {
     setSessBusy(true);
     try {
       await api.logoutOthers();
+      // Every API token went with the other sessions: the Tokens tab must not show them from cache.
+      void qc.invalidateQueries({ queryKey: qk.apiTokens() });
       notify({ level: "success", message: t("settings.account.sessions.done") });
     } catch (e) {
       notifyActionError(e, t("settings.account.sessions.failed"));
@@ -404,7 +406,9 @@ function SignInMethods({ me }: { me: Me }) {
       setOpen(false);
       setCurrent("");
       setNext("");
-      // Refresh `me` so has_password flips and the section switches to "Change password".
+      // Refresh `me` so has_password flips and the section switches to "Change password". Every API
+      // token went with the old password, so the Tokens tab must not show them from cache either.
+      void qc.invalidateQueries({ queryKey: qk.apiTokens() });
       await qc.invalidateQueries({ queryKey: qk.me() });
       notify({
         level: "success",