Signed-in devices with per-row and bulk sign-out — the current session is highlighted and never revocable, rejected revokes keep the row with a retry, and loading/empty/error are first-class states.