Revoke User Sessions

Bump users.session_version to invalidate the user's active JWTs.

Platform-admin only. Used for incident response when WorkOS Directory Sync can't deliver fast enough — phished credentials, urgent offboard, customer security request, etc. The next request from any of the user's sessions will fail with session_revoked; they can re-authenticate immediately to mint a fresh token.