Invalidate sessions when privileges change

When you promote, demote, or revoke a user's roles, existing sessions often keep the previous permissions until they expire. That gap is a common auth bug: the admin panel shows the new role, while the token still carries the old one.

On every privilege change (role update, group membership, or account disable), invalidate that user's existing sessions or force a re-auth. Store a session version, or permission epoch, on the user record. Bump it when privileges change, and reject tokens or sessions that lag behind the current version.

Do not rely on JWT expiry alone for demotions. A long-lived access token can keep admin rights after you thought you removed them. Prefer short-lived access tokens plus server-side session or version checks for sensitive actions, so a stale credential fails closed.