feat(users): companion linking store (schema v6, device sessions, link challenges) (#2174)

Part 1 of 3 for #2173 (companion linking). This PR adds only the
`users.db` side: the schema and store methods the server (part 2) and
ingestor (part 3) build on. No route, no UI and no behaviour change for
a running server.

## Changes in this PR

- **Design spec** `docs/specs/2026-10-08-companion-linking-design.md`,
including the optional linked-only ingest.
- **Schema v6** (`internal/users/schema.go`):
- `sessions` gains `kind` (`'web'` or `'device'`), `label` and `scopes`
(`''` = full, for web sessions).
- `companion_links (pubkey PRIMARY KEY, user_id, name, linked_at)`,
cascading on user delete.
- `link_challenges`: single-use challenges bound to a user and a pubkey,
with an expiry.
- **Device sessions** (`sessions.go`): create a device session with a
label and scopes, list sessions with kind and label.
- **Challenges** (`challenges.go`): issue and consume a challenge
exactly once; consumed, expired, or bound to another user or pubkey all
fail.
- **Companion links** (`companions.go`): link, list, unlink. Linking a
pubkey that belongs to another user moves it and reports the previous
owner (transfer detection), so the server can audit and mail.
- **Janitor**: the existing janitor also prunes expired challenges
(`cmd/server/auth_service.go`, 3 lines).

## Upgrade note

The store migrates `users.db` to v6 on start. A binary that only knows
v5 refuses to open a v6 file (`users: database schema version 6 is newer
than this binary supports (5)`), so rolling back after this lands needs
the pre-upgrade `users.db` backup.

## Verification

- `internal/users`: new tests for the v6 migration from v5, device
sessions, challenges (single use, expiry, binding) and companion links
(transfer, cascade on user delete). `go vet` and `go test ./...` green.
- `cmd/server` full suite green against the v6 store.

## Not in this PR

- Routes, bearer auth and the link handshake: part 2.
- Ingestor filter, account page and "My coverage": part 3.

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

cmd/server/auth_janitor_challenges_test.go

@@ -0,0 +1,27 @@
+package main
+
+import (
+	"errors"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/meshcore-analyzer/users"
+)
+
+func TestJanitorPrunesExpiredLinkChallenges(t *testing.T) {
+	f := newAuthFixture(t)
+	dave := f.registerAndActivate(t, "dave@example.org", "Dave", pw)
+	pk := strings.Repeat("cd", 32)
+	f.st.SetClock(func() time.Time { return time.Now().Add(-10 * time.Minute) })
+	ch, _, err := f.st.CreateLinkChallenge(dave.me.ID, pk)
+	if err != nil {
+		t.Fatal(err)
+	}
+	f.st.SetClock(time.Now)
+	f.srv.auth.prune()
+	// Pruned → missing. Without the janitor it would still be there, expired.
+	if err := f.st.ConsumeLinkChallenge(dave.me.ID, pk, ch); !errors.Is(err, users.ErrChallengeMissing) {
+		t.Fatalf("expired challenge survived the janitor: %v", err)
+	}
+}

cmd/server/auth_service.go

@@ -149,6 +149,9 @@ func (a *authService) prune() {
 	if _, err := a.st.PruneExpiredSessions(); err != nil {
 		log.Printf("[users] prune sessions: %v", err)
 	}
+	if _, err := a.st.PruneLinkChallenges(); err != nil {
+		log.Printf("[users] prune link challenges: %v", err)
+	}
 	if _, err := a.st.PruneTokens(7 * 24 * time.Hour); err != nil {
 		log.Printf("[users] prune tokens: %v", err)
 	}