Bulk Presence

Return {user_id: {online, last_seen_at}} for the requested users in one round-trip.

Auth accepts either a Bearer JWT (agents / API clients) or a session cookie (the web inbox polls this every 30 s). Cap of 200 ids per call — enough for an inbox of ~150 conversations

• the active-conversation header. Per-user rate limit of 30/min covers a 30 s polling cadence comfortably. Inlined instead of using require_rate_limit because that dep is bearer-only and we need to gate session callers too.

Unknown ids (never registered presence, evicted past the window) appear with {online: false, last_seen_at: null}; the contract is "every id you asked about appears in the response."

Each entry may also be a username (2026-09-15); it is answered under the username as sent, and an unknown one reads as offline.