My toy projects I include the IP address in the JWT payload, so JWT is only good for that IP. I don't always see that in examples. Not sure any downsides of that (if client is rotating IPs or VPN I may be blocking them anyway). But seems consistent with cookie concept that a login is only good on that device.

I think its a debate. I like to keep the db clean of sessions but easy enough to keep in server memory if I down the server I don't mind making people login again.