Verify session token

Verify a session identity token issued for a captain session. The caller must have access to the project that owns the session so the endpoint cannot be used for cross-tenant enumeration. Failure responses are intentionally opaque: only expired is distinguished from invalid, and callers should always confirm the returned projectId matches the project they expect before trusting the result.