fix: remove terminal module and implement concurrent log stream limiting

internal/modules/users/module.go

@@ -8,9 +8,17 @@ import (
 
 const ModuleID = "users"
 
-type Module struct{}
+// sessionStore is the subset of SessionStore that password changes need:
+// invalidate all existing sessions for a user whose password just changed.
+type sessionStore interface {
+	DeleteByUsername(username string) error
+}
 
-func New() *Module { return &Module{} }
+type Module struct {
+	sessions sessionStore
+}
+
+func New(sessions sessionStore) *Module { return &Module{sessions: sessions} }
 
 func (m *Module) ID() string   { return ModuleID }
 
@@ -21,7 +29,7 @@ func (m *Module) Permissions() []rbac.Permission {
 }
 
 func (m *Module) Register(api huma.API) {
-	registerUsers(api)
+	registerUsers(api, m.sessions)
 }
 
 func op(permission string) map[string]any {