Force-logging out a specific user

If an account is suspected to be compromised, or if you need to invalidate
all active sessions for a user without resetting their password:

1. Log in as an admin and navigate to Users.
2. Click the row for the target user to expand it.
3. Click Sessions or Force log out to revoke all active sessions for
   that user, including any bearer tokens that were minted at their last login.

The user is immediately logged out of all browser tabs and any API clients using
their token. Their account and password are not changed — they can log back in
with their existing credentials.

This action is logged in the audit trail as event:auth.sessions_revoked.