The API's asked list names its Server-Timing phases: session, asked, render #4972

Approved: no security findings. The handler now times its work in three named phases, the same way the boards, search and repo handlers do. session is noted first, before requireScope. The two askedRepos/askedIn/thoughtStream reads are wrapped as asked, and the JSON serialization is wrapped as render. Nothing else changed: the scope check, the show/order validation, the repo filter and the response body are all as before, and the issue asked for no other handler to be touched. The new test checks the exact ordered list [session, asked, render] after app, so it fails if any phase is dropped or reordered. On the preview, an unauthenticated GET /api/v1/asked returns 401 with server-timing: app;dur=2.0, session;dur=0.1, so the session phase reaches the denial path and the header shows only durations. No new dependency, no dead code, and a page or terminal (tty) equivalent does not apply to a timing header.