Which sessions hold an open WebSocket lives only in the running server's
memory, so `t3 auth session list` read from the database alone always
printed connected:false. When a server runtime state is recorded, the CLI now
asks that server through GET /api/auth/clients with a short-lived access:read
session, revoked before the list is read, and fails loudly if the server does
not answer instead of reporting every session as disconnected.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>