A session and the user it belongs to. user is null when the session
outlived its user, which the caller reports and clears — never mistake it for
a token nobody ever had.
readonly
user: UserAuthFields | null
Usage
import { type SessionWithUser } from "doc.ts";