Plan B Session Test

Phase 3A — proves the custom JWT session + narrow read endpoint.