Refactor API to use nested sessions/devices routers and fix test infrastructure

- Update API contract to use nested router structure for sessions and devices
  (me.sessions.list, me.devices.getInfo, etc.)
- Update frontend Svelte components to use new nested API paths
- Fix test assertion patterns for consistency (remove async () => wrappers)
- Fix test-db.ts findRepoRoot to use existsSync for directory checking
  (Bun.file().exists() returns false for directories)
- Add ESLint config override for test files to handle expect().rejects patterns

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/api-server/src/__tests__/e2e/webauthn.test.ts

@@ -10,7 +10,7 @@
 import type { Database } from "@reviq/db-schema";
 import type { Kysely } from "kysely";
 import type { APIContext } from "../../context.js";
-import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { call } from "@orpc/server";
 import { VirtualAuthenticator } from "@reviq/virtual-authenticator";
 import { router } from "../../router.js";
@@ -64,7 +64,7 @@ function createAPIContext(sessionToken?: string): APIContext {
  * Create a real session in the database and return the token
  */
 async function createSession(userId: number): Promise<string> {
-  const token = "test-session-" + String(Date.now()) + String(Math.random());
+  const token = `test-session-${String(Date.now())}${String(Math.random())}`;
   const tokenHashValue = await hashToken(token);
   const expiresAt = new Date(Date.now() + SESSION_EXPIRY_MS);
 
@@ -90,7 +90,7 @@ async function createLoginRequest(
   userId: number,
   email: string,
 ): Promise<{ id: number; token: string }> {
-  const token = "test-login-" + String(Date.now()) + String(Math.random());
+  const token = `test-login-${String(Date.now())}${String(Math.random())}`;
   const expiresAt = new Date(Date.now() + 10 * 60 * 1000); // 10 minutes
 
   const result = await getDb()
@@ -104,7 +104,7 @@ async function createLoginRequest(
     .returning("id")
     .executeTakeFirstOrThrow();
 
-  return { id: result.id, token };
+  return { id: Number(result.id), token };
 }
 
 /**