issue

Start a new session: create a fresh refresh token record bound to the user (and DPoP key if present).

details used to set the cookie (id and expiry)

userId

numeric id of the user

jwkThumbprint

optional DPoP key fingerprint to bind this session to the browser key