Sessions

• GET /session → current user, wallets, links, export flag

• POST /logout → ends session

Frontends must include credentials:

await fetch('https://<BASE_URL>/session', { credentials: 'include' });