fix(service): make bearer auth stateless and remove unneeded sessions

[newmanw]

MAGE's authenticated API/token traffic was accidentally relying on express-session everywhere: passport.authenticate('bearer') defaults to session:true unless told otherwise, so every bearer-authenticated request across ~80 call sites was silently establishing/regenerating a session cookie. Combined with global session middleware and in-memory MemoryStore, concurrent requests could race each other's session state, intermittently leaving req.user unpopulated on requests that otherwise carried a valid token (observed as intermittent 400s loading /ui_plugins/* assets).

• Scope express-session to only the OAuth2 SSO signin/callback routes (oauth.js), the one flow that legitimately needs it (passport-oauth2's CSRF state store and our origin stash both require req.session). Remove the global session()/passport.session() middleware.
• Remove SAML's and the deprecated /api/devices local-auth route's req.login() calls, which established sessions no code depended on.
• Add { session: false } to every passport.authenticate('bearer') call, and centralize it as a single security.authentication.bearerAuthentication middleware (added to AuthenticationInitializer's returned auth layer) instead of each route file constructing its own.
• Simplify /ui_plugins auth: drop the custom access-token-to-header copy and req.user pre-check, since passport-http-bearer already reads access_token from the query string natively; the old code was manufacturing a token-in-two-places state that passport-http-bearer's own CSRF guard then rejected with 400.