The OpenAPI document describes a person's sign-ins and ending one #5150

Intent: a harness can find and end a lost device's session from the OpenAPI document alone.

Done:

• [ ] src/contract/openapi.ts has rows for GET /api/v1/users/{username}/signins and DELETE /api/v1/users/{username}/sessions/{id}. Each has auth, the token scope its handler requires (the signins read asks for an admin-scope token), its success status when not 200, and its refusals by stable error code. Each summary says the answer's shape as the handler answers it today, and that no session secret is ever answered
• [ ] Placed as one block directly after the /api/v1/tokens/{id} row, changing no other row
• [ ] test/openapi.test.ts still passes, and a new test asserts each new path and method is in the served document

Parked by the crew: the check failed ("storage quota > an account at the limit is measured again at most every REWALK_MS") and the decider saw no point in another try (pull #5165 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.