The /api/v1/tokens and /api/v1/sessions routes move out of src/http/api.ts into src/http/api/tokens.ts, unchanged #7447

Intent: same as the user-routes split. A token or session change is security work, and reviewing it should not mean scrolling a 5,751-line file.

Done:

• [ ] The /api/v1/tokens… and /api/v1/sessions… routes move to src/http/api/tokens.ts as tokenRoutes(router, …), in the shape of src/http/api/labels.ts. api.ts calls it once.
• [ ] No route, status, body or header changes: the existing tests pass untouched and bun x tsc --noEmit is clean.

Files: src/http/api.ts, src/http/api/tokens.ts (new).

Risk: a pure move.