The API's here read, behind the forge toolbar, names its Server-Timing phases: session, here, render #5010

Done: GET /api/v1/here answer a Server-Timing header naming session, here, render, in that order, the way GET …/tags does (notePhase(ctx.request, "session", takeSessionTime(ctx.request)), then timePhase/timePhaseAsync around the read and around json(…)). The bodies, status codes and access rules do not change.

• [ ] Each route above names its phases; a refused read (401/403/404) still names session.
• [ ] One test per route asserts the header's phase names in order (pattern: test/crew-timing.test.ts), and fails without the change.
• [ ] bun test for the touched files passes.

Files: src/http/api.ts, one new test file. Risk: none to behaviour; keep the access check outside the read's phase, and never put a name, token or value in a phase.