Terminate deleted user sessions immediately

Drop the special case that deferred terminating the connection issuing
the delete, so deleting yourself behaves the same as revoke-token and
every session of the deleted user is closed before the handler returns.

Set tokenValidAfter to the current time in createUser instead of 0.
Deleting a user and recreating it under the same name left tokens issued
before the deletion valid, as the check is iat < tokenValidAfter. Doing
it in createUser covers every path that makes a user. A token signed in
the same second as creation is still accepted, so create-admin and the
other production paths sign after the user exists and are unaffected.

The integration harness signed the control token at import time, before
bootstrap create-admin created the user. Sign it in the root before hook
instead and reuse it in link.js.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

packages/controller/src/ControlConnection.ts

@@ -1071,13 +1071,7 @@ export default class ControlConnection extends BaseConnection {
 
 		this._controller.users.deleteUser(user);
 		for (let controlConnection of this._controller.wsServer.controlConnections.values()) {
-			if (controlConnection.user.id !== user.id) {
-				continue;
-			}
-			if (controlConnection === this) {
-				// Let the response go out before dropping our own session
-				setImmediate(() => controlConnection.connector.terminate());
-			} else {
+			if (controlConnection.user.id === user.id) {
 				controlConnection.connector.terminate();
 			}
 		}

packages/controller/src/UserManager.ts

@@ -119,7 +119,9 @@ export default class UserManager {
 			roles.add(defaultRoleId);
 		}
 
-		const user = new User(this.records, this._controllerRoles, 0, name, roles);
+		// Reject tokens issued before the user existed, e.g. for a previous user by the same name
+		const tokenValidAfter = Math.floor(Date.now() / 1000);
+		const user = new User(this.records, this._controllerRoles, tokenValidAfter, name, roles);
 		this.records.set(user);
 		return user;
 	}