No concurrent session limit per user

[Bccorb]

Part of #155. Session 7. Gated on purchasing the GovRAMP Security Snapshot.

Problem

There is no cap on the number of simultaneous active sessions a user may hold.
issueSessionAndRespond (src/services/sessionIssuance.ts)
creates a new session row on every successful authentication and never considers
existing ones.

Why it matters

NIST 800-53 AC-10, concurrent session control. It is a standard question in a
government security review, and for shared-workstation environments (which the
migration runbook targets explicitly) an unbounded session count is also an
operational problem, not only a compliance one.

What to do

• Add a configurable maximum concurrent sessions per user, defaulting to unlimited
  so existing deployments are unaffected
• Decide the eviction behaviour: refuse the new session, or revoke the oldest.
  Revoking the oldest is friendlier and is what most products do
• Emit an auth event when a session is evicted

Acceptance

• The limit is configurable and off by default
• Exceeding it behaves per the documented policy and produces an audit event

Freeze status

Anticipated GovRAMP finding (exception 2).

Ripple

@seamless-auth/types SystemConfigSchema gains a key.