- Add Express Request type augmentation for req.session
- requireAuth now sets req.session after session validation,
so protected handlers can read the user without calling
getSession again
- Add ConflictError (409) alongside existing AppError subclasses