Session ingest API

POST /api/v1/kya/sessions/ingest (API key auth, merchant-scoped).

Body is AgentEvent-compatible JSON. Risk is derived and stored for raise-only policy. Operator list: /app/kya/sessions.

Full field notes live in repo docs/dev/kya-session-ingest.md.