auth: rename api.Token -> api.Session (and methods) to reflect reality

These rows are OAuth refresh-token families (login sessions), not personal access tokens — the CLI never mints them. Rename so the types are self-documenting and drop the "Despite the api.Token name…" caveat:

api.Token -> api.Session api.TokensResponse -> api.SessionsResponse (wire key stays "tokens") (*Client).ListTokens -> ListSessions (*Client).RevokeToken -> RevokeSession (*Client).RevokeCurrentToken -> RevokeCurrentSession

cli: authTokenLister -> sessionLister defaultListTokens -> defaultListSessions defaultRevokeCurrentToken -> defaultRevokeCurrentSession newAPITokensClient -> newSessionsClient

Pure rename: wire paths and JSON field names are unchanged, so the server contract is untouched.