Story-2878: Session-lifetime config + remote logout entry point (RFD-AGT-013 T2c-b)

A lost or stolen phone must be killable from any web session immediately. RFD-AGT-013 (D18/D19, CC-25/CC-45) makes remote logout the stolen-phone kill switch: one action ends every PRAMAAN session on every device and disconnects the counsel's conversational channels, so a thief holding an enrolled WhatsApp number gets nothing — the channel refuses the number and every outstanding document link dies with the sessions. This story ships the app-side entry point under Settings → Account → Sign-in & devices.

Settings → Account → Sign-in & devices → "Log out everywhere" → destructive confirm → bindings revoked, every Clerk session revoked → channel refuses the counsel until re-enrollment with a one-time code.

What the action does, in order

Kill-switch failure semantics

• A binding-revoke (or binding-list) failure never aborts the session sweep — a stolen phone must not stay logged in because the WhatsApp wiring hiccuped. Partial failures come back as a localized warning toast and are logged (remote_logout.binding_* / remote_logout.session_* events with trace_id).
• Only a total failure of the Clerk session list fails the action (ok:false, localized formError, no sign-out — the counsel stays signed in and can retry).
• The confirm dialog disables both buttons while the action is in flight, so a double-press cannot fire the sweep twice.

Where the UI reflects the channel consequence

• Confirm dialog body states it up front: "Mira will refuse messages from your connected numbers until you reconnect them with a one-time code under Settings → Channels." This mirrors the functions-side contract (zero-amp shield STATIC_REFUSAL_TEXT, Story-2850: the refusal tells the sender to re-connect under Settings → Channels with a one-time code) — the refusal itself is enforced functions-side, not invented here.
• Success toast repeats the consequence when at least one binding was revoked (successToastChannels), before the client signs out.

What is deliberately NOT in this story

• Session-lifetime config UI. Neither the pramaan-functions contract (verified against the OpenAPI snapshot on main) nor Clerk's Backend API exposes a per-user session-lifetime setting — session lifetime is an instance-level Clerk dashboard configuration per environment (Development vs Production), which is exactly the "existing app-level setting" the RFD names. Nothing to build; no fake control was invented.
• Link-kill via the revocation epoch — the per-(firm, user) epoch + wrapper-token sweep is functions-side Story-2863 (T3b-3); v1 kills sessions/bindings only, per the ticket.
• Multi-firm binding sweep. The bindings contract is firm-scoped (the caller's active firm); bindings in a counsel's other firms are out of reach of this endpoint. Their fetch links still die with the sessions (D18); the residual converse-level access is the RFD's accepted-residual stack. Flagged in the PR body.
• Connect/Disconnect channel management UI — that is Story-2877 (T2c-a).

Files

• src/app/[locale]/(workspace)/settings/account/security/page.tsx — server shell (auth via requireOkAppMe; deliberately NO settings:write gate — remote logout is the counsel's own kill switch), binds the action, exports agentSurface (settings.account-security).
• src/app/[locale]/(workspace)/settings/account/security/actions.ts — remoteLogoutAction server action (typed RemoteLogoutResult, localized errors via getTranslations).
• src/lib/channels/gateway.ts — server-only channels gateway; both calls assertContract-validated against the generated Zod schemas (HR-21/HR-22).
• src/components/settings/security/account-security-page.tsx — client orchestrator; AccountSecurityPage is pure (action + sign-out injected), AccountSecurityPageWithClerk is the live wrapper injecting Clerk signOut.
• src/components/settings/security/remote-logout-dialog.tsx — destructive AlertDialog confirm (repo-standard bg-destructive action), pending-proofed.
• src/components/settings/settings-sidebar.tsx — new Account group with the Sign-in & devices item.
• openapi/app-api.json + openapi/permission-map.json — mirrors synced to pramaan-functions main (additive: the five /app/channels/* endpoints only) per the openapi mirror guard; src/gen regenerated (PRAMAAN_FUNCTIONS_OPENAPI pinned to the mirror, per LI-6).
• messages/en.json + messages/hi.json — new AccountSecurity namespace, SettingsNav.groupAccount / signInAndDevices, and AgentSurfaces.settingsAccountSecurity, in BOTH locales.

Test evidence

pnpm vitest run "src/app/[locale]/(workspace)/settings/account/security/actions.test.ts" \
  src/components/settings/security/account-security-page.test.tsx

• API wiring (7 tests, actions.test.ts): unauthenticated → refusal touching nothing; bindings revoked strictly BEFORE sessions; already-revoked bindings skipped; session list paginated so no device survives; binding-revoke failure and binding-list failure both still kill sessions (warning returned); Clerk session-list failure fails closed with no sign-out; individual session-revoke failure warns.
• Confirm flow (5 tests, account-security-page.test.tsx): confirm opens with the channel-refusal consequence stated; confirm runs the action, toasts the consequence, signs out; partial-sweep warning still signs out; action failure → error toast, dialog closed, NO sign-out; pending state blocks double-confirm (label swap + both buttons disabled).

CC-25 live check (human UAT)

The LIVE half of the ticket's test ("logout → channel refused") needs a real enrolled number against staging: enroll a WhatsApp number (T2c-a flow), run remote logout from Settings → Account → Sign-in & devices, then message Mira from that number — the zero-amp shield's static refusal replies (or silence within the window), enforced functions-side. The app-side half (this story) is covered by the tests above.