feat(config): publish a concurrent session limit

[Bccorb]

Publishes the config key that seamless-auth-api#176 needs. Enforcement is the
server's job and lands separately; this is the shared shape only.

The key

max_concurrent_sessions: z.number().int().positive().nullable().default(null),

How many sessions one user may hold at once. null means no limit and is the
default, so a deployment that predates the key behaves exactly as it does today.

null rather than 0 for unlimited. Zero would otherwise read as "no sessions
allowed", which is a plausible way for an operator to try to remove a cap and
lock every user out instead. The schema refuses zero, and any negative or
fractional value, on both SystemConfigSchema and SystemConfigPatchSchema.

Why

NIST 800-53 AC-10, concurrent session control, which is a standard question in a
government security review. It is also an operational concern wherever
workstations are shared, since an unbounded session count leaves sessions alive
on machines a user has walked away from.

Consumers

Additive and defaulted, so nothing breaks. The API will read it to decide when to
evict; the admin dashboard gets the key for free once it picks up the release.

npm run typecheck, npm run lint, npm run format:check, npm run build and
npm test all pass (218 tests, 16 files), and the built dist carries the key on
all three schemas.