Single-device login staging tests
ENABLE_SINGLE_DEVICE_LOGIN=false

[PASS] Valid device_id parses
[PASS] Invalid device_id rejected
[PASS] Legacy device meta has minimum length
[PASS] Flag OFF: missing device_id parse returns null
[FAIL] Database connection
DB note: SQLSTATE[HY000] [2002] No such file or directory (run migrations/add_user_sessions.sql on server)

Manual API test matrix (run on staging with real JWTs):
1. Login Device A -> expect 200 + jwt
2. Call protected API from Device A -> expect 200
3. Login same account on Device B -> expect 200 + new jwt
4. Call protected API from Device A -> expect 401 logout:true SESSION_REVOKED
5. Call protected API from Device B -> expect 200
6. POST /v1/user/logout from Device B -> expect 200
7. Call protected API from Device B -> expect 401

Results: 4 passed, 1 failed