Terminate deleted user sessions immediately

Drop the special case that deferred terminating the connection issuing
the delete, so deleting yourself behaves the same as revoke-token and
every session of the deleted user is closed before the handler returns.

Set tokenValidAfter to the current time in createUser instead of 0.
Deleting a user and recreating it under the same name left tokens issued
before the deletion valid, as the check is iat < tokenValidAfter. Doing
it in createUser covers every path that makes a user. A token signed in
the same second as creation is still accepted, so create-admin and the
other production paths sign after the user exists and are unaffected.

The integration harness signed the control token at import time, before
bootstrap create-admin created the user. Sign it in the root before hook
instead and reuse it in link.js.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

test/controller/UserManager.test.js

@@ -79,6 +79,23 @@ describe("controller/UserManager", function () {
 			const user = userManager.createUser("Eve");
 			assert(user.roleIds.has(1));
 		});
+
+		it("should set tokenValidAfter to the current time", function () {
+			const before = Math.floor(Date.now() / 1000);
+			const user = userManager.createUser("Mallory");
+			assert(user.tokenValidAfter >= before, "tokenValidAfter predates the call");
+			assert(user.tokenValidAfter <= Math.floor(Date.now() / 1000), "tokenValidAfter is in the future");
+		});
+
+		it("should invalidate tokens issued before a user of the same name was recreated", function () {
+			const user = userManager.createUser("Niaj");
+			const oldTokenIat = user.tokenValidAfter - 60;
+			userManager.deleteUser(user);
+
+			// WsServer.registerControl rejects the token when iat < tokenValidAfter
+			const recreated = userManager.createUser("Niaj");
+			assert(oldTokenIat < recreated.tokenValidAfter, "token from before the deletion is still valid");
+		});
 	});
 
 	describe(".getOrCreateUser()", function () {