auth: show active sessions in `auth status`; logout targets same core

Bring back the sessions table now that it correctly lists entire-core login sessions (not entire.io PATs), so the effect of logout / logout --all is visible:

• auth status lists the active sessions (NAME / CREATED / LAST USED / EXPIRES) on the active context's core, after the profile/context lines, with a hint tying the table to logout and logout --all. Best-effort: a listing failure is a soft note (liveness already confirmed via /me).
• logout now revokes against the active context's core too (shared resolveStatusTarget), so it acts on exactly the sessions status shows — not a static AuthBaseURL. Fixes the same multi-core mismatch for logout.
• newSessionsClient takes an explicit coreURL.