docs: Correct the middleware fallback in the plan

The plan's Middleware called sessionFromToken even when sessionFromCookie
had already answered a rejected cookie, putting two JSON bodies on the
wire for the ordinary expired-session case. Found in review of Task 5.

docs/superpowers/plans/2026-08-12-api-tokens-openapi.md

@@ -822,6 +822,12 @@ func Middleware() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		sess, ok := sessionFromCookie(c)
 		if !ok {
+			// A cookie that was presented and rejected has already been
+			// answered. Falling through would put a second JSON body on the
+			// wire for the ordinary expired-session case.
+			if c.IsAborted() {
+				return
+			}
 			sess, ok = sessionFromToken(c)
 		}
 		if !ok {