Stateless session verification: no writes, no replacement tokens (CDI 5.5)

On CDI >= 5.5, session verification performs no DB writes and never returns a replacement access token:

• The stateless early return no longer requires parentRefreshTokenHash1 == null — any validly signed, unexpired token short-circuits.
• Verify-time promotion is removed (rotation now happens at refresh).
• The implicit payload-update token swap is removed; with checkDatabase = true the response carries payloadUpdateAvailable: true when the stored payload differs, and no token is minted.
• With checkDatabase = true, access tokens whose refresh-token lineage matches neither current nor prev are rejected with unauthorised (the client refreshes; the refresh path holds the real reuse checks).

CDI <= 5.4 verify behavior is unchanged.

Depends-on: #1301 Plan: PLAN-002