Realtime Access

Resolve a Stytch session token + trip_id into our internal user_id.

Called by Hocuspocus's onAuthenticate to gate WebSocket handshakes. Returns 401 on bad token, 404 on no/insufficient trip access (the latter delegated to verify_trip_access so we share rules with HTTP routes).