Returns every ANKATech support-access (impersonation) session whose start
boundary falls inside the requested window, most recent first — with the
operator, the window, why the session ended, and the FULL list of actions
taken inside it.

Derived entirely from the signed audit events, never from the grant or
session rows admin-api holds. The session row carries ON DELETE CASCADE on
the grant, revoke deletes the grant and the reconciler purges lapsed ones — so
a row-based view would be empty at exactly the two moments this view exists to
serve. The signed support-access.session.started / .session.ended events in
admin_audit_log survive both, so this history remains readable after the
grant is revoked and purged.

A session is one .session.started paired with the next .session.ended for
the same operator. An unpaired start is an open session and is rendered as
such (open: true, no endedAt, no endCause) — it is not an omission. An
end boundary whose start lies before the requested window is omitted; widen
from to include it. Two operators inside one grant are two entries, because
the grouping key includes the operator.

The session JTI is never projected — it is a live revocation key and is not a
value this service can reach.

The window is always bounded: omitting from / to applies a 90-day lookback
ending now rather than scanning all history. The maximum span is 365 days.

The action list is bounded too, and independently: the time window caps how far
back the view reaches, not how many rows sit inside it, and one scripted or bulk
operation performed during a session produces arbitrarily many. Each session
therefore projects at most 500 actions, oldest first, and sets
actionsTruncated: true when it held more. The truncation is never silent —
reading a cut list as though it were complete is the one misreading this view
cannot afford.