fix: 踢出用户时清除所有 session，确保旧 token 立即失效

- kickOfflineByUserDeviceLogic: 管理员踢设备后新增 clearAllSessions，
  之前只清单个 WebSocket session，用户可用旧 token 继续访问
- unbindDeviceLogic: 家庭成员被踢时增加踢设备+清 session；
  补全 session detail key 清理

Co-Authored-By: claude-flow <ruv@ruv.net>

internal/logic/admin/user/kickOfflineByUserDeviceLogic.go

@@ -2,7 +2,9 @@ package user
 
 import (
 	"context"
+	"fmt"
 
+	"github.com/perfect-panel/server/internal/config"
 	"github.com/perfect-panel/server/internal/svc"
 	"github.com/perfect-panel/server/internal/types"
 	"github.com/perfect-panel/server/pkg/logger"
@@ -38,5 +40,47 @@ func (l *KickOfflineByUserDeviceLogic) KickOfflineByUserDevice(req *types.KickOf
 		return errors.Wrapf(xerr.NewErrCode(xerr.DatabaseUpdateError), "update Device error: %v", err.Error())
 	}
 
+	// 清除该用户的所有会话，确保旧 token 失效
+	l.clearAllSessions(device.UserId)
+
 	return nil
 }
+
+// clearAllSessions 清除指定用户的所有会话
+func (l *KickOfflineByUserDeviceLogic) clearAllSessions(userId int64) {
+	sessionsKey := fmt.Sprintf("%s%v", config.UserSessionsKeyPrefix, userId)
+	sessions, err := l.svcCtx.Redis.ZRange(l.ctx, sessionsKey, 0, -1).Result()
+	if err != nil {
+		l.Errorw("获取用户会话列表失败",
+			logger.Field("user_id", userId),
+			logger.Field("error", err.Error()),
+		)
+		return
+	}
+
+	if len(sessions) == 0 {
+		return
+	}
+
+	pipe := l.svcCtx.Redis.TxPipeline()
+	for _, sessionID := range sessions {
+		if sessionID == "" {
+			continue
+		}
+		pipe.Del(l.ctx, fmt.Sprintf("%v:%v", config.SessionIdKey, sessionID))
+		pipe.Del(l.ctx, fmt.Sprintf("%s:detail:%s", config.SessionIdKey, sessionID))
+	}
+	pipe.Del(l.ctx, sessionsKey)
+
+	if _, err = pipe.Exec(l.ctx); err != nil {
+		l.Errorw("清理会话缓存失败",
+			logger.Field("user_id", userId),
+			logger.Field("error", err.Error()),
+		)
+	}
+
+	l.Infow("[KickOffline] 管理员踢设备-清除所有Session",
+		logger.Field("user_id", userId),
+		logger.Field("count", len(sessions)),
+	)
+}