feat(server): /svc/sessions names who has which project open

A grant lasts the session's school day; a connection ends with the tab.
The dashboard needs the second to end a teacher's write share that holds
for one session (F7.1, "Mitarbeiten" in "Alle Projekte").

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/server/test/access.test.ts

@@ -412,7 +412,25 @@ describe("the dashboard's service", () => {
       { user: mia, project, level: 'write' },
       { user: ben, project: other, level: 'read' },
     ].sort((x, y) => (x.user + x.project).localeCompare(y.user + y.project));
-    expect(await answer(await service(server, 'GET', '/svc/sessions'))).toEqual([200, { users: [mia, ben].sort(), grants }]);
+    expect(await answer(await service(server, 'GET', '/svc/sessions'))).toEqual([200, { users: [mia, ben].sort(), grants, open: [] }]);
+    await server.close();
+  });
+
+  it('lists who has which project open: connected, once per person and project; a closed tab is gone', async () => {
+    await sql.query('DELETE FROM filius_session');
+    const server = await start();
+    const [project, other] = [await newProject(), await newProject()];
+    const [mia, ben] = [randomUUID(), randomUUID()].sort() as [string, string];
+    const miaCookie = await signIn(server, project, { user: mia });
+    const tab = await join(server, project, { cookie: miaCookie });
+    const second = await join(server, project, { cookie: miaCookie });
+    await signIn(server, other, { user: ben });
+    const open = async () => ((await (await service(server, 'GET', '/svc/sessions')).json()) as { open: unknown }).open;
+    expect(await open()).toEqual([{ user: mia, project }]);
+    tab.close();
+    expect(await open()).toEqual([{ user: mia, project }]);
+    second.close();
+    await until(async () => ((await open()) as unknown[]).length === 0);
     await server.close();
   });