fix: Stop the session middleware writing two responses on an expired cookie

sessionFromCookie already writes "session expired" when a cookie was
presented and rejected with no bearer to fall through to. Middleware
called sessionFromToken anyway, which wrote a second "not authenticated"
body onto the same response for every ordinary browser-session timeout -
gin logged "superfluous response.WriteHeader call" on ordinary use, not a
rare edge case.

Guard on c.IsAborted() after sessionFromCookie: true only in that one
rejected-cookie-no-bearer branch, so it short-circuits there while the
other three credential paths (no credential, bearer only, stale cookie
plus valid bearer) are unaffected.

server/internal/auth/middleware.go

@@ -61,6 +61,13 @@ func Middleware() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		sess, ok := sessionFromCookie(c)
 		if !ok {
+			// A cookie that was presented and rejected has already had its
+			// response written by sessionFromCookie (no bearer was present to
+			// fall through to). Trying sessionFromToken anyway would write a
+			// second body onto the same response.
+			if c.IsAborted() {
+				return
+			}
 			sess, ok = sessionFromToken(c)
 		}
 		if !ok {