Potentially error

in the session recovery example, potential error

application/api/auth.2/restore.js
```
({
access: 'public',
method: async ({ token }) => {
const restored = context.client.restoreSession(token);
if (restored) return { status: 'logged' };
const data = await api.auth.provider.readSession(token);
return { status: data ? 'logged' : 'not logged' };
},
});
```

If the token is not in sessions, we check it in the database, but after that we don't add it to sessions.

Example: context.client.startSession(token, data);

Start with application/api/auth.2/restore.js and inspect context.client.restoreSession, api.auth.provider.readSession, and context.client.startSession. Done means a token found in the database is added to sessions so subsequent recovery uses the session path and still reports the correct logged or not-logged status.

Written by the indexing model from the issue text.