feat(be): add a session record to the account reference schema

[sea-snake]

Design: #4224, on the storage of #4222. Overview: #4230. The schema only — #4266 is what writes a session.

An app delegation is unrevocable for as long as it is valid, which is up to 30 days: the client holds a self-contained canister-signed artifact whose verification never consults the canister again. The fix needs somewhere to put a long-lived, revocable record, and #4222 gives a capped, evictable per-account store to hang it on.

A session is (created_at, valid_till, last_refreshed, browser_id, read_only) on the account reference. Nothing else. Putting it there rather than in a map of its own means it inherits the per-anchor caps that already bound references, so revoking, expiring and evicting reuse machinery that exists.

• The field is Option, so references written under the previous schema decode unchanged, and an empty list is not stored.
• Only last_refreshed is mutable, which is why it is the one field that will not feed the session's seed: a mutable input would change the session's principal every time it was stamped.
• A list carries no eviction exemption for holding a session. The list is what makes an app visible in settings, so sparing it would leave the user access they cannot see, and a session nobody can find is a session nobody can revoke. What an eviction costs is a ceremony, not an account: the account is computed, so it returns at the identical principal on the next sign-in.
• reclaim_order ranks dead sessions first, then live ones on last_used + (last_used - created_at) — recency extended by how long the session stayed in service, so an app in weekly use outranks one opened once yesterday. feat(be): cap sessions per identity #4267 is what enforces a cap with it.

AccountReference::new replaces the struct literals, so adding the field did not spread across every construction site.

Tests: session_tests (11), including a reference written before sessions existed decoding with none, a list holding a session being evictable like any other, and a flood of unused sessions failing to displace a used one.

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 709ce21.

Security Overview

• 🔎 Scanned files: 11 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/6d3e3b61-710b-4b2b-9c0b-43458b6314b6?scanId=14aa897d-32ee-4332-9cb5-301f0c14ddd1&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► src/internet_identity/src/storage/account.rs     Add AccountReference::new constructor and integrate with existing AccountReference usage ► src/internet_identity/src/storage/storable/account_reference.rs     Update to store and convert Sessions within AccountReference ► src/internet_identity/src/storage/storable/session.rs     Add StorableSession with (de)serialization support ► src/internet_identity/src/storage/storable/browser_id.rs     Add StorableBrowserId type alias ► src/internet_identity/src/storage/storable/duration.rs     Add StorableDuration type alias ► src/internet_identity/src/storage/storable/timestamp.rs     Add StorableTimestamp type alias ► src/internet_identity/src/storage/storable/mod.rs     Include new storable modules (browser_id, duration, session, timestamp)
Bug Fix	► src/internet_identity/src/storage.rs     Replace direct AccountReference construction with AccountReference::new in multiple places ► src/internet_identity/src/storage/storable/account_reference_list.rs     Use AccountReference::new for test reference construction ► src/internet_identity/src/storage/tests.rs     Update test expectations to use AccountReference::new for default/named references
Refactor	► src/internet_identity/src/storage/storable/account_reference.rs     Refactor AccountReference to include sessions and new constructor ► src/internet_identity/src/storage/storable/account_reference.rs     Adjust From/Into implementations to handle new sessions field ► src/internet_identity_interface/src/internet_identity/types.rs     Introduce BrowserId type alias for per-anchor browser labeling

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.