Реализовать кластер-безопасные admin refresh-сессии (фаза 1, #23).

Единая auth_session с refresh JWT, rotation и reuse detection; CI/CD временно на workflow_dispatch.

Co-authored-by: Cursor <cursoragent@cursor.com>

include/records.hrl

@@ -61,6 +61,20 @@
   type            :: refresh
 }).
 
+%% ------------------- ЕДИНАЯ МОДЕЛЬ СЕССИЙ (refresh JWT) ----------------
+-record(auth_session, {
+  session_id    :: binary(),
+  family_id     :: binary(),
+  subject_id    :: binary(),
+  subject_type  :: user | admin,
+  client_type   :: binary(),
+  current_jti   :: binary(),
+  expires_at    :: calendar:datetime(),
+  revoked       :: boolean(),
+  created_at    :: calendar:datetime(),
+  updated_at    :: calendar:datetime()
+}).
+
 %% ------------------- Календари ---------------------------------------
 -record(calendar, {
   id              :: binary(),