feat: add session token authentication

[vinimachadosantana]

What

Adds a Session model with secure tokens, an authentication concern reading the Authorization header, and login/logout endpoints.

Why

Database-backed bearer tokens over JWT: revocation is a delete, so banning a user or logging out everywhere takes effect immediately. The trade-off is a session lookup per request, which is acceptable at this scale and cheap to cache later.

How

• Authentication is required by default so forgetting a check locks an endpoint rather than exposing it.
• authenticate_by is constant-time, so response timing can't be used to discover which emails are registered.
• Sessions record IP and user agent, giving an audit trail and the basis for a "log out other devices" feature later.
• has_secure_token generates cryptographically random tokens.
• A spec proves a revoked token is rejected immediately.

Testing

• Login, logout, missing token, and revoked token all covered
• Identical error message for unknown email and wrong password
• RuboCop and Brakeman clean