feat: add active sessions dashboard API

[Priveetee]

Summary

• Add an opt-in activeSessionsEnabled admin setting with a safe default of false
• Add in-memory active session reporting/listing APIs for admin session dashboards
• Keep privacy boundaries: no IP collection, no sensitive headers, truncated user agent only when enabled

Verification

• JAVA_HOME=<jdk17> ./gradlew clean check shadowJar --no-daemon
• Beta Docker image pulled and recreated via docker-compose.dev-mirror.yml
• Runtime beta curl verified setting off/on, session listing, and stop clearing nowPlaying