update api and login

src/app/api/auth/sessions/route.ts

@@ -1,5 +1,6 @@
 import type {NextRequest} from 'next/server';
 import {authApi} from '@/services/api/authApi';
+import {refuseOffConsole} from '@/features/auth/services/serverSession';
 import {serveUpstream} from '@/shared/services/bff';
 import {toDeviceSession} from '@/features/settings/services/mapSession';
 
@@ -14,6 +15,8 @@ export const dynamic = 'force-dynamic';
  * from the browser they are reading the page in.
  */
 export async function GET(req: NextRequest) {
+  const refused = await refuseOffConsole();
+  if (refused) return refused;
   return serveUpstream(req, (token) => authApi.sessions(token), (list) =>
     list.map(toDeviceSession),
   );