getSessionState(userId: string):
Returns the user's live role and their last password change, before which
their tokens don't count, or undefined when the user is gone, or comes from
another instance while an admin blocks it or the deployment turns sign-ins
from other instances off (FEDERATION.incoming). lib/auth.ts checks
every session and media token against it.