resolve() now requires sess_fp == live_fp for every session that carries
a fingerprint (including human_via_agent), so a redeem-vs-rekey race
cannot leave a view:read bearer alive. Drop the duplicate view_ttl key
in issue_code's return dict. Regression tests cover both.
