CI / check (push) Has been cancelled
Adds a JWT-gated, read-only session-restore route. Mirrors POST /login's projection and 200 body shape exactly so normalizeBotData on the client is unchanged. extractPubkeyFromAuth (already imported later in the file for /regenerate-secret) covers missing/malformed/forged/expired/ blacklisted tokens via verifyJwt; deduped the now-redundant import at the /nostr/session section. All 7 auth-me.test.ts cases pass; tsc clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>