feat(bot): manage device policy via telegram commands

internal/service/token_svc.go

@@ -84,6 +84,9 @@ func (s *TokenService) IssuePair(ctx context.Context, userID, role, tier string)
 	if err := s.repo.RefreshToken.Create(ctx, rt); err != nil {
 		return nil, err
 	}
+	if err := s.repo.RefreshToken.RevokeOldestActiveByUserID(ctx, userID, s.maxActiveRefreshTokens(ctx)); err != nil {
+		s.log.Warn("failed to enforce refresh token session limit", zap.String("user_id", userID), zap.Error(err))
+	}
 
 	return &TokenPair{
 		AccessToken:  accessToken,
@@ -93,6 +96,14 @@ func (s *TokenService) IssuePair(ctx context.Context, userID, role, tier string)
 	}, nil
 }
 
+func (s *TokenService) maxActiveRefreshTokens(ctx context.Context) int {
+	cfg := loadBotConfig(ctx, s.repo)
+	if cfg.MaxLoggedClients < 1 {
+		return defaultBotConfig().MaxLoggedClients
+	}
+	return cfg.MaxLoggedClients
+}
+
 // issueAccessToken 签发 JWT Access Token（HS256，60分钟有效期）。
 func (s *TokenService) issueAccessToken(userID, role, tier string) (string, error) {
 	claims := Claims{