Add keepalive-status, a log-only session health check

Summarises the running container's keepalive: extension count, latest
budget, transient failures, rejections, restarts.

It deliberately makes no API call. Any authenticated request slides the
session TTL, so a checker that talked to Schulcloud would be sustaining
the session itself and could not report on whether the keepalive is
doing it — the same confound that made the first endurance test
ambiguous. Reading container logs observes without participating.

Warns when the reported budget drops below 7000s, which is the early
signal that extensions have stopped taking effect.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/AUTH.md

@@ -113,8 +113,15 @@ permanently and says what to do, because a deleted whitelist entry cannot be
 revived by retrying — and if it happens roughly two hours after login, suspect
 an open tab before anything else.
 
-`npm run session-diagnose` logs the budget every 10 minutes for ~2.5 h, which is
-the direct way to confirm a token is holding.
+Two ways to check that a token is holding:
+
+- `npm run keepalive-status` reads the running container's logs and summarises
+  its extensions. It makes **no** API call on purpose — any authenticated
+  request slides the TTL, so a checker that talked to Schulcloud would be
+  keeping the session alive itself and could not tell you whether the keepalive
+  works.
+- `npm run session-diagnose` calls refresh-session every 10 minutes for ~2.5 h
+  and logs the budget, for when there is no container to read logs from.
 
 **Operational consequence:** if the container is down for over two hours the
 session lapses on its own, and restarting will not recover it. The startup log