- as updates to API Sessions can now happen later than the last time
they were active, updatedAt is no longer the correct representation of
the last activity an API Session had
- move all logic that used updatedAt to lastActivityAt
- add migration to set lastActivityAt
- http requests should hard timeout w/ a reasonable response
- edge routers should close when an API session token is not provided or
does not match
- stream both types of sessions on edge router connect
- stream sessions for time out processing/deletion
- add id to session messages (edge control pb update, breaks backwards
compat)