fix(server): token actor, login CSRF, 415, cookie decoding, admin invites, production default

- API writes pass token:<name> for Bearer requests and "user" for sessions.
- X-Requested-With: sttracker on every non-Bearer write, login and register included.
- JSON-body routes reject non-JSON content types with 415.
- A malformed stt_session cookie counts as no cookie (401), not 500.
- DELETE me/tokens/:id is 404 for unknown or foreign ids; admin/invites is admin-only.
- Bun.serve development mode only with NODE_ENV=development or --hot.
- OpenAPI documents multipart fields.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/server/src/routes/attachments.ts

@@ -24,6 +24,7 @@ export const attachmentRoutes = [
     summary: "Upload a file (multipart: file, entity, entityId, caption) and link it to one of your records.",
     auth: "any:write",
     multipart: true,
+    formFields: fields,
     handler: async ({ deps, user, form }) => {
       const file = formFile(form);
       const f = fields.parse({