fix: invalidate stale Socket.IO sessions on role change and user deletion (#23642)

SESSION_POOL caches user.role at connection time and never refreshes it. When an admin demotes or deletes a user, their socket sessions retain the old cached role until voluntary disconnect, allowing continued use of admin-gated socket features (ydoc editing, channel access).

Adds disconnect_user_sessions() helper that disconnects all sockets for a user ID. Called from update_user_by_id (on role change) and delete_user_by_id. The client auto-reconnects and re-authenticates with fresh DB data.

backend/open_webui/socket/main.py

@@ -312,6 +312,24 @@ async def enter_room_for_users(room: str, user_ids: list[str]):
         log.debug(f'Failed to make users {user_ids} join room {room}: {e}')
 
 
+async def disconnect_user_sessions(user_id: str):
+    """Disconnect all Socket.IO sessions belonging to a user.
+
+    Call this when a user's role is changed or the user is deleted so that
+    stale role/permission data cached in SESSION_POOL is invalidated.
+    The client will automatically reconnect and re-authenticate with
+    fresh data from the database.
+    """
+    try:
+        session_ids = get_session_ids_from_room(f'user:{user_id}')
+        for sid in session_ids:
+            await sio.disconnect(sid)
+        if session_ids:
+            log.info(f'Disconnected {len(session_ids)} session(s) for user {user_id}')
+    except Exception as e:
+        log.warning(f'Failed to disconnect sessions for user {user_id}: {e}')
+
+
 @sio.on('usage')
 async def usage(sid, data):
     if sid in SESSION_POOL: