A new password signs the account out everywhere (#334)

ipx user passwd, the one way to change a password and the step taken
when one may be known to someone else, only replaced the hash. Every
session stayed, and session_user moves `seen` on each use, so a
session someone kept using never reached the idle cutoff.

set_password now deletes the account's sessions too. API tokens stay:
a reset that broke every script would be a reason not to reset, and
the owner lists and removes tokens in Settings. The command says how
many still work.

Also corrects the first-start log line from #321: there is no way to
change a password in the page, so it names the command alone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/cli.md

@@ -31,7 +31,7 @@ Passwords are read from **stdin**, so they miss the shell history and any `ps` l
 ```sh
 echo -n 'a good password' | ipx user add ray          # local account
 ipx user add ray@example.com --no-password            # signs in through the proxy only
-echo -n 'a good password' | ipx user passwd admin     # change a password
+echo -n 'a good password' | ipx user passwd admin     # change a password; signs the account out everywhere
 ipx user list                                         # who exists, and how each signs in
 ipx user rm sam                                       # account, subscriptions and read state
 ```