docs: reorder & testing

backend/internal/auth/cache.go

@@ -136,6 +136,29 @@ func (c *Cache) Remove(deviceSessionID uuid.UUID) {
 	}
 }
 
+// ListByUser returns a freshly-allocated snapshot of every cached
+// session belonging to userID. The user-surface "list my sessions"
+// handler consumes this. An empty slice is returned for an unknown
+// userID.
+func (c *Cache) ListByUser(userID uuid.UUID) []Session {
+	if c == nil {
+		return nil
+	}
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	set, ok := c.byUser[userID]
+	if !ok {
+		return nil
+	}
+	out := make([]Session, 0, len(set))
+	for id := range set {
+		if sess, ok := c.byID[id]; ok {
+			out = append(out, sess)
+		}
+	}
+	return out
+}
+
 // RemoveByUser evicts every cached entry belonging to userID and returns
 // the device_session_ids it removed. The returned slice is safe for the
 // caller to hold past the call — it is freshly allocated.