SessionInfo marks lastUsedAt and expiresAt optional, but the API declares them required

[Bccorb]

src/core/sessions.ts declares:

export interface SessionInfo {
  lastUsedAt?: string;
  expiresAt?: string;
  ...
}

The auth API's SessionSchema declares both as required strings. One of the two is wrong, and it is worth settling which:

• If the API always sends them, the CLI's optionality is dead defensiveness, and toSessionInfo's str() helper silently turns an unexpected non-string into undefined rather than surfacing a malformed response.
• If the API can omit them (for example a session row written before those columns existed), then the shared schema is too strict and will throw when a consumer parses rather than casts.

The same helper drops a session entirely when id is not a string, which means a malformed row disappears from seamless sessions output with no warning.

Worth checking against a real instance, then either relaxing SessionSchema in @seamless-auth/types or tightening this interface. Related: #144, which proposes replacing toSessionInfo with schema parsing.