func EnsureActiveOnLogin(userID uint, deviceKey, ua, ip string) error
EnsureActiveOnLogin is used only in login flow:
- If session exists (even Inactive): reactivate and refresh fields.
- If not exists: apply max-devices policy, then create Active session.