Report headless sessions' content-free totals and state to Den's session index

For the headless runner only, with Authorization: Bearer $DEN_HEADLESS_RUNNER_CALLBACK_TOKEN. Body { updates: [{ capability, sessionId, version, fields }] }, at most 50. Each update carries the index capability Den minted with the session's turn; the organization, member and kind come from it alone and sessionId must be its session. Idempotent on (sessionId, version): a version at or below the stored one is stale and changes nothing. One result per update, in order: ok, stale, or rejected with a code (rate_limited per session and organization: keep and retry it; index_disabled is no longer sent but older runners keep and retry it too). Rejections are audited. Answers 404 when DEN_HEADLESS_RUNNER_CALLBACK_TOKEN is not configured.