Publish curated ITWorx-Pulse source from 0e0633c8ac91cb71312a26837f791035a78d81b8

docs/architecture/API_CONTRACT.md

@@ -44,6 +44,7 @@ No stack trace or secret-bearing upstream response.
 | `GET /auth/callback` | public-oidc | `internal/authapi/handler.go` |
 | `GET /auth/test-login` | development-only | `cmd/api/main.go` |
 | `POST /session/logout` | session | `cmd/api/main.go` |
+| `GET /api/v1/session` | view | `internal/sessionapi/handler.go` |
 | `GET /api/v1/system/status` | view | `internal/systemstatusapi/handler.go` |
 | `GET /api/v1/system/diagnostics` | operate | `internal/systemstatusapi/handler.go` |
 | `GET /api/v1/system/metrics` | operate | `internal/observability/metrics.go` |
@@ -127,7 +128,7 @@ No stack trace or secret-bearing upstream response.
 
 ### Session/user
 
-OIDC login and callback are the only public authentication routes. The browser session is server-side and intentionally has no introspection or preference endpoint in v1. Logout clears the opaque session cookie. Sessions use a bounded sliding idle lifetime: a successful authenticated request renews the HttpOnly cookie after half of the idle TTL has elapsed, while a separate absolute TTL always requires a new OIDC login. The defaults are eight hours idle and seven days absolute; production rejects an absolute TTL below 24 hours because an authenticated wallboard is a supported 24-hour workload. The mock test-login route returns `404` unless both the environment is non-production and mock authentication is configured.
+OIDC login and callback are the only public authentication routes. The browser session is server-side. `GET /api/v1/session` exposes only the authenticated subject, effective role, derived permission booleans and configured environment so the operator shell can present current context; it never exposes tokens, raw claims, cookie material or preference mutations. Logout clears the opaque session cookie. Sessions use a bounded sliding idle lifetime: a successful authenticated request renews the HttpOnly cookie after half of the idle TTL has elapsed, while a separate absolute TTL always requires a new OIDC login. The defaults are eight hours idle and seven days absolute; production rejects an absolute TTL below 24 hours because an authenticated wallboard is a supported 24-hour workload. The mock test-login route returns `404` unless both the environment is non-production and mock authentication is configured.
 
 ### Health