MCP `sessions` lists the caller's sign-ins #5147

Intent: a person can see from their agent where they are signed in. First half of #4796, which was parked twice on tests it never touched (test/measure.test.ts, the board's burst-of-errors test).

Done:

• [ ] src/http/mcp.ts has a sessions tool, placed right after access, taking { username? }. It calls accountSignIns (what GET /api/v1/users/:username/signins calls) with the same rules: the same token scope and the same refusals, and username defaults to the caller
• [ ] The answer lists what the API lists (device, place, when, which one is current) and never a session secret, plus a says sentence
• [ ] docs/MCP.md has its row beside access
• [ ] test/mcp-sessions.test.ts: a person with two sign-ins sees both; a stranger naming another person is refused as the route refuses them
• [ ] test/mcp-size.test.ts still passes. Keep the description to one short sentence

Before pushing run test/mcp-sessions.test.ts, test/mcp.test.ts and test/mcp-size.test.ts. If a test elsewhere goes red, check whether main is red on it too and say so in the pull.

Ready again: pull #5159 was closed because main moved under it and it could not be brought up to date. Conflicting files: docs/MCP.md, src/http/mcp.ts.