feat(security): audit-log session termination (single + all-others)

The two session-revocation endpoints wrote no audit entry. Added a 'session' EntityType (+ Czech label 'Relace') and logAudit on both deletes, so revoking sessions is recorded in the forensic trail.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/admin/lib/entityTypeLabels.ts

@@ -36,4 +36,5 @@ export const ENTITY_TYPE_LABELS: Record<string, string> = {
   work_plan_entry: "Plán prací – záznam",
   work_plan_override: "Plán prací – přepsání dne",
   plan_category: "Plán prací – kategorie",
+  session: "Relace",
 };