Paul Lorenz 8e9bfb21fc Restore legacy API session activity marking for REST requests. Fixes #4367 ...

- resolves zt-session tokens eagerly when the request context is created, so every request carrying one marks activity and gets session lifetime headers, regardless of endpoint
- marks last activity in SecurityCtx.resolveZtSession once the session is loaded
- adds SecurityTokenCtx.HasZtSessionHeader, a header-only check that does not parse bearer tokens
- emits only session lifetime headers from the API wrappers and drops the unused session-error header branch, so a stale token on an anonymous endpoint stays silent as it did on 1.6.x
- tests that requests to authenticated and anonymous endpoints with a zt-session mark activity, carry lifetime headers, and are reflected by current-api-session

(cherry picked from commit 9761ad8da8)

2026-09-09 17:22:36 -04:00

..

policy

Filter service policies by string type in enforcer/list queries. Fixes #4141

2026-07-22 15:49:22 -04:00

routes

Restore legacy API session activity marking for REST requests. Fixes #4367

2026-09-09 17:22:36 -04:00