fix(web): make active-session tokens revocable

[eshurakov]

Summary

• Issue pepper-bearing one-hour viewer JWTs from activeSessions.getToken.
• Invalidate the session-ingest auth cache after committed single-user blocks and soft deletes.
• Keep bulk-block paths TTL-only and add focused coverage and rollout documentation.

This is the PR2 follow-up to #5325, which is merged into main. PR1 session-ingest enforcement is already in main.

Verification

• pnpm --filter web lint
• pnpm --filter web typecheck
• git diff --check
• Focused Jest tests were attempted but blocked before assertions because the PostgreSQL test database was unavailable.

Rollout notes

• Existing pepper-less viewer tokens remain accepted until their one-hour expiry.
• Existing authenticated WebSocket connections are not forcibly closed by this change.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Reviewed PR 5343's web token-revocation follow-up (invalidation client, post-commit block/soft-delete hooks, TTL-only bulk-block comments, and getToken coverage) with high confidence that changed code matches the planned post-commit / best-effort contract.

Files Reviewed (13 files)

• apps/web/src/lib/session-ingest-client.ts
• apps/web/src/lib/session-ingest-client.test.ts
• apps/web/src/lib/session-ingest-client-unset.test.ts
• apps/web/src/lib/user/block.ts
• apps/web/src/lib/user/block-invalidate.test.ts
• apps/web/src/lib/user/index.ts
• apps/web/src/lib/user/soft-delete-invalidate.test.ts
• apps/web/src/lib/abuse/bulkBlock.ts
• apps/web/src/app/admin/api/backfills/block-blacklisted-domains/route.ts
• apps/web/src/routers/active-sessions-router.test.ts
• SESSION-INGEST-TOKEN-REVOCATION-HANDOFF.md
• SESSION-INGEST-TOKEN-REVOCATION-PLAN.md
• SESSION-INGEST-TOKEN-REVOCATION-REMEDIATION-PLAN.md

---

_{Reviewed by grok-4.6 · Input: 174.6K · Output: 38.7K · Cached: 2M}

_{Review guidance: REVIEW.md from base branch main}