fix(auth): the session row must carry the id the token claims

The sid revocation check added in e2589d4 rejected EVERY authenticated request
with 401. issue_session generated session_id = Uuid::new_v4(), minted the access
token with it as sid, then called create_session WITHOUT passing it, so Postgres
assigned the row a different primary key. is_session_live(sid) therefore never
matched and the liveness check failed closed on every call.

Both halves were individually correct, which is why unit tests did not catch it:
303 backend tests passed throughout. The e2e suite caught it, as a wallet that
authenticated successfully and then showed 0 for every asset.

NewSession now carries the id explicitly and create_session binds it, at all
three call sites (extension/website login and the refresh rotation, which shares
the helper).

Verified: fiat-balance e2e goes from all-zero to $108.21.

src/api/auth.rs

@@ -224,6 +224,7 @@ async fn issue_session(
     state
         .db
         .create_session(NewSession {
+            id: session_id,
             user_id,
             refresh_token_hash,
             platform: platform.to_string(),

src/api/website.rs

@@ -302,6 +302,7 @@ pub async fn website_verify(
     state
         .db
         .create_session(NewSession {
+            id: session_id,
             user_id: user.id,
             refresh_token_hash,
             platform: Platform::Web.to_string(),