Migration 097 backfilled every existing user with auth_version '0',
so on upgraded installs a stolen JWT signing key alone could mint a
session; fresh installs also need the per-user random epoch. Each such
user gets a random one, which ends their current sessions once.
