User authentication and session management for web applications
drop unused [loc] dep from 22 packages
[monopam lint] flagged [loc] as declared-but-not-needed across:
bottler, dupfind, ocaml-agent / auth / freebox / gauth / hap / http /
linkedin / merlin / meross / oauth / osv / paseto / requests / runc /
scaleway / sigstore / spacedata / stix, plus prune and space.
These packages don't import [Loc] directly — they only pull in
[Json.Error] or similar high-level facades, which re-export the
[Loc] surface they need. Drop the stale declaration so the opam
depends stay honest.