Feat(Chore): Verify Flow, Invites, Suspend, Depart Cert Policy

feat: add password reset and email verification flow
feat: add org invite listing, cancellation, and invite link fallback
feat: add user suspend/unsuspend with audit logging
feat: add department certificate policy (expiry, extensions)
feat: enforce dept cert policy on SSH certificate signing
feat: wire up OIDC consent and token flow (replace mocks)
feat: rework CLI auth bridge to use frontend login flow
feat: add admin OAuth provider management (CRUD)
chore: refactor model import paths after module reorganisation
chore: clean up config, decorators, and dev tooling

gatehouse_app/services/session_service.py

@@ -1,6 +1,6 @@
 """Session service."""
 from datetime import datetime, timezone
-from gatehouse_app.models.session import Session
+from gatehouse_app.models.user.session import Session
 from gatehouse_app.utils.constants import SessionStatus
 
 
@@ -17,7 +17,7 @@ class SessionService:
         Returns:
             Session object if found and active, None otherwise
         """
-        from gatehouse_app.models.session import Session
+        from gatehouse_app.models.user.session import Session
         from gatehouse_app.utils.constants import SessionStatus
         return Session.query.filter_by(
             token=token,