fix: keep the sign-out watermark monotonic and drop the session foreign key

Backing the watermark off by 26 hours to stay clear of time-zone skew also moved
it backwards, which would re-validate tokens somebody had deliberately
invalidated in that window by changing or resetting their password. It now takes
the later of the two values, so it can only ever move forward.

The foreign key on user_session.user_account_id is gone. Hibernate cannot see it
- the column is plain by design, because the row is written by native upserts on
the auth hot path - so the migration check kept generating a changeset to drop
it. It also turned emitting a token into something that requires the account row
to be visible to the current transaction, which broke
TranslationsControllerHistoryTest. Orphans age out with the purge, the same way
activity_revision.author_id is handled.

Author: JanCizmar

backend/data/src/main/kotlin/io/tolgee/model/UserSession.kt

@@ -35,7 +35,10 @@ class UserSession : StandardAuditModel() {
   lateinit var deviceId: String
 
   /**
-   * Plain column rather than a relation - the row is written by native upserts on the auth hot path.
+   * Plain column rather than a relation - the row is written by native upserts on the auth hot path,
+   * and no foreign key backs it: emitting a token must not require the account row to be visible to
+   * this transaction yet. Orphans age out with the purge, the same way `activity_revision.author_id`
+   * is handled.
    */
   @Column(name = "user_account_id", nullable = false)
   var userAccountId: Long = 0

backend/data/src/main/resources/db/changelog/schema.xml

@@ -5883,12 +5883,6 @@
             <column name="expires_at"/>
         </createIndex>
     </changeSet>
-    <changeSet author="jancizmar" id="1785400000000-5">
-        <addForeignKeyConstraint baseColumnNames="user_account_id" baseTableName="user_session"
-                                 constraintName="fk_user_session_user_account" deferrable="false"
-                                 initiallyDeferred="false" onDelete="CASCADE" referencedColumnNames="id"
-                                 referencedTableName="user_account" validate="true"/>
-    </changeSet>
     <changeSet author="jancizmar" id="1785400000000-6">
         <createTable tableName="auth_audit_event">
             <column name="id" type="BIGINT">
@@ -5941,7 +5935,7 @@
             until real time caught up. Erring the other way only leaves the newest pre-upgrade
             tokens valid, and those get a session row from the backfill path on first use anyway.
         </comment>
-        <sql>UPDATE user_account SET tokens_valid_not_before = now() - interval '26 hours' WHERE deleted_at IS NULL;</sql>
+        <sql>UPDATE user_account SET tokens_valid_not_before = greatest(coalesce(tokens_valid_not_before, to_timestamp(0)), now() - interval '26 hours') WHERE deleted_at IS NULL;</sql>
         <rollback/>
     </changeSet>
     <changeSet author="jancizmar" id="1785400000000-11">