fix(api): accept documented session-create defaults

[cursor]

Bug and impact

Documented session-create calls omit namespace (docs.html, OpenAPI, playground sample), but the handler required it after the credit deduction step. A user following the published curl or playground sample could lose 5 credits and receive 400 namespace is required instead of a session.

Root cause

/v1/tools/session-create deducted credits before validating request shape, then rejected missing namespace even though the public contract advertised it as unnecessary.

Fix

• Default omitted namespace to default.
• Validate namespace/model before deducting credits.
• Keep existing owner binding and x402 model pin behavior unchanged.

Validation

• npm run build && node tests/session-pricing.test.mjs
• DATABASE_URL=postgresql://arch:arch@localhost:5432/arch_dev TEST_BASE_URL=http://localhost:8787 node tests/session-ownership.test.js