fix: clear revoked Guardian sessions

Return a removed Guardian's browsers to their own record.

src/lib/sharing/grants.ts

@@ -542,6 +542,10 @@ export async function revokeManagedProfileGuardian(input: {
         where: { id: target.id },
         data: { revokedAt: new Date(), revokedBy: "GRANTOR" },
       });
+      await clearActingSessions(
+        { grantorId: profile.id, granteeId: target.granteeId },
+        tx,
+      );
       return tx.accountGrant.findUniqueOrThrow({ where: { id: target.id } });
     });
   });

tests/integration/managed-profile-lifecycle.test.ts

@@ -306,6 +306,10 @@ describe("managed profile lifecycle (real Postgres)", () => {
       { params: Promise.resolve({ id: invitation.id }) },
     );
     expect(accepted.status).toBe(200);
+    await getPrismaClient().session.update({
+      where: { id: secondGuardian.sessionId },
+      data: { actingAsUserId: profile.id },
+    });
 
     cookieJar.set("healthlog_session", creator.sessionId);
     const { DELETE: revokeGuardian } =
@@ -323,6 +327,11 @@ describe("managed profile lifecycle (real Postgres)", () => {
         where: { id: invitation.id },
       }),
     ).toMatchObject({ revokedBy: "GRANTOR" });
+    expect(
+      await getPrismaClient().session.findUniqueOrThrow({
+        where: { id: secondGuardian.sessionId },
+      }),
+    ).toMatchObject({ actingAsUserId: null });
   });
 
   it("rolls managed Guardian acceptance back when the grant update fails", async () => {