A test pins session cookies: a forged, expired or signed-out session reads as signed out everywhere #7169

sessionUser in src/core/sessions.ts answers invalid_session for a token it does not accept, and no test names it.

Done:

• [ ] A new test: a random token, a real token with one character changed, a session past its expiry, and a session ended by signing out each give invalid_session.
• [ ] Over HTTP, each of those cookies gets the signed-out page on / and 401 on GET /api/v1/user.
• [ ] A cookie for a suspended account is refused the same way.
• [ ] A live session still works.

Files: test/session-refusals.test.ts

If the test finds the behaviour wrong, fix the module it names in the same pull and say so. If the check fails in a test this pull does not touch, name it in the pull rather than widening the change.

Before pushing: bun x tsc --noEmit and the new test.