feat(relay): implement GET /xrpc/com.atproto.server.getSession (MM-81) #55

Summary#

Adds GET /xrpc/com.atproto.server.getSession — the first authenticated XRPC route
Accepts both legacy HS256 tokens (from createSession) and ES256 OAuth access tokens via the AuthenticatedUser extractor; rejects refresh-scope tokens with InvalidToken
Returns { did, handle, email, emailConfirmed, didDoc } with didDoc omitted when no document is stored for the account
Adds get_session_account DB query (single JOIN over accounts + handles + did_documents)
Removes placeholder #[allow(dead_code)] from AuthenticatedUser and AuthScope

8 unit tests covering: valid token, confirmed email, DID doc present, missing auth, invalid token, expired token, refresh token rejected, deactivated account
app.rs 501 test updated to use refreshSession NSID
Manual: createSession → use accessJwt against getSession via Bruno (get_session.bru)
Manual: verify expired/tampered token returns 401 with correct error codes