Whether the caller has a live session cookie

Always 200. Returns { authenticated: boolean } and nothing else, no email, no plan, no key material. Intended for public pages that need to know whether to render a signed-in nav, without a 401 in the console for every logged-out visitor.