Create Session

Verify the master key and set the HttpOnly session cookie.

The session is bound to the bootstrap operator identity, so every request it later authenticates resolves a user and that user's active organization rather than only "the master key was presented once". The response names both, so a client knows who it is signed in as without a second call.

The rate-limit check deliberately runs only after a failed verification, not before it: a pre-verification gate can't know whether this attempt would have succeeded, so once an IP has used up its failure quota it would end up blocking that IP's legitimate owner too, not just further attackers. The issue this implements explicitly rules that out. The DB/hash lookup this exposes to repeated attempts only runs when no fixed master_key is configured (the auto-generated bootstrap-key path); with a configured master_key, verification is a constant-time string compare, not a DB round trip.