fix(auth): refusing a revoked session no longer deletes a newer sign-in's cookie

The refusal cleared the session, so a request in flight with the previous account's cookie
answered with a cookie deletion that could land after a sign-in as someone else. A revoked id is
refused on every request anyway. Also a test for the pruning of old revocations.

backend/app/auth.py

@@ -368,9 +368,11 @@ def _session_user(request: Request, db: Session, user_id: int | None) -> User:
     if epoch is None or int(epoch) != (user.session_epoch or 0):
         request.session.clear()
         raise refused(401, "not_authenticated")
-    # A session signed out (or replaced by a sign-in as someone else) whose cookie landed late.
+    # A session signed out (or replaced by a sign-in as someone else) whose cookie landed late. Not
+    # cleared: this request may have left before a sign-in as someone else answered, and a cookie
+    # deletion landing after that sign-in's cookie would sign the browser out of it. A revoked id is
+    # refused on every request and never renewed, so leaving its cookie costs nothing.
     if db.get(RevokedSession, _session_id(request)) is not None:
-        request.session.clear()
         raise refused(401, "not_authenticated")
     _renew_session(request)
     # Attribute this request's log lines to the account. Here, not in the request middleware: