auth: burn all PAT machinery; sessions/logout target entire-core only

entire.io's ent_ personal-access-token surface (/api/v1/auth/tokens) is being sunset, and the CLI never used it for auth — it authenticates with the core JWT. Remove every trace from this repo:

• Drop the dead Provider.AuthTokensPath field (and its /api/v1/auth/tokens values + tests); nothing references the entire.io PAT path anymore.
• Rename the api.Client session plumbing off PAT-era naming: api/auth_tokens.go -> api/sessions.go, WithAuthTokensPath -> WithSessionsPath, authTokensPath -> sessionsPath, errAuthTokensPathUnset -> errSessionsPathUnset.
• Scrub PAT / ent_ / personal-access-token mentions from comments.

Session management (auth status liveness via /me, logout revocation) targets entire-core's /api/auth/tokens on the auth host (api.AuthBaseURL()) with the session-scoped core JWT — never entire.io's PAT endpoint, so the 400 from that endpoint cannot recur.