feat: Sprint 2 — Wursor-side pairing flow + signed plugin client

- session store + requireSession middleware (signup persists session)
- PairingService (8-char code, 5-min TTL, 5-attempt lockout, single-use, https check)
- POST /sites/pair, /sites/redeem, /sites/:id/confirm, GET /sites/:id
- PluginClient signs HMAC (timestamp+method+path+body-hash), token in Authorization
- ADR 0016; 58 api tests green

api/src/services/session-store.ts

@@ -0,0 +1,26 @@
+import { generateToken } from '../lib/codes.ts';
+
+export type Session = {
+  token: string;
+  userId: string;
+  createdAt: number;
+};
+
+export interface SessionStore {
+  create(userId: string): Promise<Session>;
+  findByToken(token: string): Promise<Session | undefined>;
+}
+
+export class InMemorySessionStore implements SessionStore {
+  private byToken = new Map<string, Session>();
+
+  async create(userId: string): Promise<Session> {
+    const session = { token: generateToken(), userId, createdAt: Date.now() };
+    this.byToken.set(session.token, session);
+    return session;
+  }
+
+  async findByToken(token: string): Promise<Session | undefined> {
+    return this.byToken.get(token);
+  }
+}