List the caller's active sessions
Returns every non-revoked session for the authenticated user. Each row is safe to render in an “Active sessions” UI — no tokens are disclosed. The session matching the request cookie is marked is_current: true, and sessions originating from the same hashed source IP as the current request are marked same_network_as_current: true. See ADR-028.
Authorizations
HttpOnly, Secure, SameSite=Lax cookie issued by /v1/auth/sign-in (or the SSO / email-callback flows). The value is an AES-256-GCM-encrypted blob of {access_token, refresh_token, issued_at, auth_method}. Browser clients include this automatically with credentials: "include".
Response
Active sessions for the current user.