feat(be): let an app sign its own session out

[sea-snake]

Design: #4224. Overview: #4230.

Signing out of an app cleared browser state and invalidated nothing already issued. app_revoke_session : () -> (variant { Ok; Err : AppSessionError }) removes the session record, so the app's access ends within one delegation lifetime instead of running to the original expiry.

• No authorization check beyond the match refresh already performs, because a caller cannot produce another session's principal and can only ever remove its own.
• A session that is already gone is Ok, so sign-out is idempotent: a client that retries, or signs out twice, gets the same answer without reasoning about whether its session was still there. Only a storage failure comes back as an error — the same error type its two siblings already return, so this is consistency with its own family rather than a new convention.
• It finds the session without the expiry check, so signing out of an already-expired session still clears the record.

The app deliberately cannot revoke anything else. "Sign out everywhere" is the II frontend's operation (#4246), not something a dapp can trigger.

Revocation latency is exactly the app-delegation TTL, by construction: revoking stops new mints and one already issued runs out. mcp.rs documents the same residue for its grants.

Tests: session_removal_tests (3) plus PocketIC coverage that a refresh working before sign-out returns NoMatchingSession after, three sign-outs in a list all succeed, an expired session is still signed out and its record and index entry go with it, and signing one browser out leaves another browser's session on the same account working.

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 0b155a4.

Security Overview

• 🔎 Scanned files: 9 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/6d3e3b61-710b-4b2b-9c0b-43458b6314b6?scanId=60c78512-6f32-432d-829a-6dea3186826b&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type

Relevant files

Enhancement

► src/canister_tests/src/api/internet_identity/api_v2.rs     Add app_revoke_session function ► src/frontend/src/lib/generated/internet_identity_idl.js     Introduce app_revoke_session in IDL ► src/frontend/src/lib/generated/internet_identity_types.d.ts     Add app_revoke_session type definition ► src/internet_identity/internet_identity.did     Declare app_revoke_session in service interface ► src/internet_identity/src/main.rs     Expose app_revoke_session update method ► src/internet_identity/src/sessions.rs     Add app_revoke_session implementation ► src/internet_identity/src/storage.rs     Implement revoke_session storage function ► src/internet_identity/src/storage/tests.rs     Add tests for session removal scenarios ► src/internet_identity/tests/integration/sessions.rs     Update imports to include app_revoke_session and related types ► src/internet_identity/tests/integration/sessions.rs     Add tests for signing out and session management

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.