fix(server): token actor, login CSRF, 415, cookie decoding, admin invites, production default

- API writes pass token:<name> for Bearer requests and "user" for sessions.
- X-Requested-With: sttracker on every non-Bearer write, login and register included.
- JSON-body routes reject non-JSON content types with 415.
- A malformed stt_session cookie counts as no cookie (401), not 500.
- DELETE me/tokens/:id is 404 for unknown or foreign ids; admin/invites is admin-only.
- Bun.serve development mode only with NODE_ENV=development or --hot.
- OpenAPI documents multipart fields.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/server/src/main.ts

@@ -40,7 +40,9 @@ const backupTimer = setInterval(() => void ensureBackup(), BACKUP_CHECK_MS);
 const app = createApp({ db, registry, secret: config.secret, dataDir: config.dataDir, publicUrl: config.publicUrl });
 const server = Bun.serve({
   port: config.port,
-  development: process.env.NODE_ENV !== "production",
+  // Production unless asked: dev mode adds HMR and verbose error pages.
+  // `bun --hot` puts the flag in execArgv, not Bun.argv.
+  development: process.env.NODE_ENV === "development" || process.execArgv.includes("--hot"),
   routes: {
     "/api/*": (req, srv) => app.fetch(req, srv),
     "/ingest/*": (req, srv) => app.fetch(req, srv),