[glm-grade=B] fix(auth): /auth/me hotfix — isValid not isSessionValid + guard (DC-093 r2)

Live verification of 4125d7a caught a 500 every 60s: the handler called
deps.session.isSessionValid(req), but the production session context
(src/context/session.js) exposes isValid — isSessionValid is only the
middleware-internal name. The round-1 test stub mirrored the wrong
name, so tests passed while prod 500'd (stub-shape-fits-bug).

- routes/auth/index.js: precompute guarded _authed (typeof isValid ===
  'function' check); malformed session object can no longer 500 a
  60s-polled endpoint. Fallback true: handler runs only after the
  session middleware admitted the request.
- routes/auth/admin.js:119: same latent 500 fixed (isSessionValid →
  isValid) — pre-existing DC-048 bug, any legacy-session /me call.
- Test stub now carries the real shape {isValid} with isSessionValid
  deliberately absent — regression to the wrong name now fails tests.

Judge: GLM-5.3 cold read round 2, grade B ship; stale-comment polish
folded in. Full suite 115/2682 green.

dashcaddy-api/routes/auth/admin.js

@@ -116,7 +116,7 @@ module.exports = function({ asyncHandler, errorResponse, log, session, dataDir }
       // `legacy: true` so the UI knows.
       return ok(res, {
         user: null,
-        authenticated: session ? session.isSessionValid(req) : false,
+        authenticated: session ? session.isValid(req) : false,
         role: 'admin', // legacy: assume operator-level access
         legacy: true,
       });