Adds the `sessions` table for storing server-side session records. Each row tracks a session ID (UUID), user ID, hashed refresh token, device info, IP address, and timestamps.