chore(v1.1.8): GC sweep for app-user sessions + tokens

Extend the existing weekly retention sweeper with a new
spawn_app_user_token_gc function that prunes four tables in one
tick:

  * app_user_sessions — expired (sliding window or absolute cap) or
    explicitly revoked
  * app_user_email_verifications — consumed or expired
  * app_user_password_resets — consumed or expired
  * app_user_invitations — accepted or expired

Each underlying repo's gc(batch_size) uses FOR UPDATE SKIP LOCKED so
concurrent sweepers don't fight (cluster mode v1.3+ ready). No
configurable retention — rows die when their TTL or terminal state
hits, not on an arbitrary clock.

Wired into picloud's build_app alongside spawn_dead_letter_gc and
spawn_abandoned_gc.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/picloud/src/lib.rs

@@ -372,6 +372,15 @@ pub async fn build_app(
         abandoned_repo.clone(),
         trigger_config.abandoned_retention_days,
     );
+    // v1.1.8 weekly sweep for app-user sessions + tokens. No
+    // configurable retention — rows are pruned as soon as they're
+    // either expired (by TTL) or consumed/revoked.
+    picloud_manager_core::spawn_app_user_token_gc(
+        app_user_sessions_repo.clone(),
+        app_user_verifications_repo.clone(),
+        app_user_password_resets_repo.clone(),
+        app_user_invitations_repo.clone(),
+    );
     // v1.1.4: cron scheduler. Polls cron_trigger_details on a tick and
     // enqueues due triggers into the outbox; the dispatcher above
     // delivers them like any other async trigger.