Current session (console)

Reads the hr_session cookie and echoes the CSRF token to use for cookie-authenticated mutations. A pure read: a caller that presents a token this session still accepts (the live one, or the token a rotation superseded, inside its grace window) gets it echoed back unchanged; a caller that presents none gets csrf_token: null and mints one with POST /v1/auth/csrf. This endpoint never rotates the session token — doing so on a read is what let a second tab, a focus revalidation or the console's own probe invalidate a request already in flight (E2E5-01, fault 76).