feat(core): harden sessions settlement and credit activity

app/Services/PlayerTokenResolver.php

@@ -192,6 +192,14 @@ final class PlayerTokenResolver
             throw new PlayerAuthenticationException('Token 已因密码变更失效', ErrorCode::PlayerTokenInvalid->value);
         }
 
+        $sessionVersion = (int) data_get($claims, 'session_version', 0);
+        if ($sessionVersion !== (int) ($player->native_session_version ?? 0)) {
+            throw new PlayerAuthenticationException(
+                '当前会话已被同账号的较新登录替换',
+                ErrorCode::PlayerSessionReplaced->value,
+            );
+        }
+
         $player->forceFill(['last_login_at' => now()])->save();
 
         return $player->refresh();