feat(platform): harden governance and approval workflows

Tiku.Infrastructure/Auth/AuthSessionStore.cs

@@ -10,6 +10,7 @@ using Tiku.Domain.Operations;
 using Tiku.Domain.Tenancy;
 using Tiku.Infrastructure.Persistence;
 using Tiku.Infrastructure.Security;
+using ZLinq;
 
 namespace Tiku.Infrastructure.Auth;
 
@@ -466,6 +467,7 @@ public sealed class AuthSessionStore(
             .ToArrayAsync(cancellationToken);
 
         return sessions
+            .AsValueEnumerable()
             .GroupBy(item => item.TokenFamilyId)
             .Select(group => new { All = group.ToArray(), Active = group.LastOrDefault(item => item.RevokedAt == null && item.ExpiresAt > now) })
             .Where(value => value.Active is not null)