[Feature]: Introduce a reusable public session DTO for admin APIs

[Bccorb]

Problem statement

Admin session payload shaping is duplicated and explicitly marked TODO, which is a good sign the API contract wants a shared type.

See code:

• src/controllers/admin.ts (line 261)
• src/controllers/admin.ts (line 321)
• src/schemas/session.responses.ts
• src/routes/admin.routes.ts

Proposed solution

One mapper/schema for admin session responses and response-validation coverage for the admin session endpoints.

Alternatives considered

No response

Impact area

None