List an IAM user's live sessions

Returns the sessions that are LIVE for the selected user right now, newest first, each carrying the non-secret sid that iam.user.revoke (target session) takes. This is the operator's view of somebody else's sessions; the user's own equivalent is GET /api/v1/auth/sessions, which returns the same row plus current. Sessions live in auth-go, not in this database — there is no local session store to enumerate — so this read is served from GET /internal/sessions?accountId=… keyed by the user's email (auth-go's account id). Validation: scopeId must be a scope the caller can access and userId must identify a user visible in that scope — unknown or out-of-scope ids return 404 via ErrNotFound. A user who exists but has no open session is 200 with an EMPTY array, never 404: "signed in nowhere" is a real answer, and answering 404 would leak the difference between an unknown user and an idle one. Async & state: Synchronous read; no state change. Not cacheable — the list is live. Errors: 401 when unauthenticated; 403 when the caller lacks an IAM-read-capable role on the scope; 404 when scopeId/userId is unknown; 500 when auth-go is unreachable, throttled or erroring. It FAILS CLOSED and never degrades to an empty list: an empty list reads as "this user is signed in nowhere", which is exactly the wrong thing to show an operator deciding whether to cut somebody's access during an incident. Idempotency/Concurrency: Safe; no idempotency key. Session tokens (the cookie secret) are never present — only sid, which is safe to display and is the revoke key.