Wire server sessions

@cavuno/board/server provides platform-neutral cookie strings and refresh coordination. The framework skills installed in the app provide request, middleware, and response APIs.

The server contract has three invariants:

1. One module-scoped board client uses server-default nostore.
2. Each request reads an app-owned httpOnly cookie and passes credentials in that call's headers.
3. One module-scoped createSessionRefresher(board) coordinates refreshes within the process or isolate.

1. Persist the board-user session

BoardSession contains { accessToken, refreshToken, expiresAt }. The codec uses one __Host- cookie with Path=/, HttpOnly, Secure, SameSite=Lax, and a 30-day Max-Age. The framework owns header I/O and CSRF controls; wrap the codec when the app requires cookie encryption.