Add admin-only /lockedUsers and /unlock endpoints to view and unlock
brute-force-locked accounts, gated by self.login.admin-user property.

Add optional concurrent login constraint (maximumSessions=1) enabled via
self.concurrent-login-constraint.enabled, returning a JSON ApiError when
a session expires due to a login from another location.

Make ApiError and its constructor public for reuse by the session
expired strategy.