The session cookie is named session_<port> so two instances on one host don't
clobber each other's cookie, but the lightweight front telemetry auth only
checked the literal "session" name — 401'ing every front-served status call.
Match the engine's get_current_user and accept any session / session_* cookie.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EPLnsRpNBzWCHLgkXATqRz