GET /api/v1/sessions · DELETE /api/v1/sessions/{id} · POST /api/v1/sessions/end-others (SS-01)
TOTP/MFA is not yet part of the SS-01 Identity contract, so we show a single labelled seam rather than a fake enrollment flow. When it ships, you'll enroll an authenticator app right here.