auth: disambiguate api session names as AuthSession

The api package is generic, so its Session/ListSessions/etc. collided conceptually with the repo's agent/checkpoint session domain (strategy.Session). Prefix the auth surface with Auth: api.Session -> AuthSession, file sessions.go -> auth_sessions.go, and the cli-package helpers (newAuthSessionsClient, defaultListAuthSessions, revokeAllAuthSessions, etc.). JSON wire key stays "tokens".