Add Session class to provide getUser() on call.session

Wraps SessionData and user into a Session class that handlers can use
via call.session.getUser() instead of accessing services directly.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

express/auth/types.ts

@@ -62,3 +62,35 @@ export const tokenLifetimes: Record<TokenType, number> = {
     password_reset: 1 * 60 * 60 * 1000, // 1 hour
     email_verify: 24 * 60 * 60 * 1000, // 24 hours
 };
+
+// Import here to avoid circular dependency at module load time
+import { AnonymousUser, type MaybeUser } from "../user";
+
+// Session wrapper class providing a consistent interface for handlers.
+// Always present on Call (never null), but may represent an anonymous session.
+export class Session {
+    constructor(
+        private readonly data: SessionData | null,
+        private readonly user: MaybeUser,
+    ) {}
+
+    getUser(): MaybeUser {
+        return this.user;
+    }
+
+    getData(): SessionData | null {
+        return this.data;
+    }
+
+    isAuthenticated(): boolean {
+        return this.user !== AnonymousUser;
+    }
+
+    get tokenId(): string | undefined {
+        return this.data?.tokenId;
+    }
+
+    get userId(): string | undefined {
+        return this.data?.userId;
+    }
+}