fix(server): token actor, login CSRF, 415, cookie decoding, admin invites, production default

- API writes pass token:<name> for Bearer requests and "user" for sessions.
- X-Requested-With: sttracker on every non-Bearer write, login and register included.
- JSON-body routes reject non-JSON content types with 415.
- A malformed stt_session cookie counts as no cookie (401), not 500.
- DELETE me/tokens/:id is 404 for unknown or foreign ids; admin/invites is admin-only.
- Bun.serve development mode only with NODE_ENV=development or --hot.
- OpenAPI documents multipart fields.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/server/src/openapi.ts

@@ -46,7 +46,15 @@ export function buildOpenApi(routes: RouteDef[], prefix = "/api/v1"): JsonSchema
     };
     if (parameters.length > 0) op.parameters = parameters;
     if (r.body) op.requestBody = { required: !r.body.safeParse(undefined).success, content: { "application/json": { schema: toSchema(r.body) } } };
-    if (r.multipart) op.requestBody = { required: true, content: { "multipart/form-data": { schema: { type: "object" } } } };
+    if (r.multipart) {
+      const fields = r.formFields ? (toSchema(r.formFields) as { properties?: JsonSchema; required?: string[] }) : {};
+      const schema = {
+        type: "object",
+        properties: { file: { type: "string", format: "binary" }, ...fields.properties },
+        required: ["file", ...(fields.required ?? [])],
+      };
+      op.requestBody = { required: true, content: { "multipart/form-data": { schema } } };
+    }
     (paths[path] ??= {})[r.method.toLowerCase()] = op;
   }
   return {