Remove unused startSession/getSessionJwt from src/api/pkg.ts

[dobby-coder]

src/api/pkg.ts exports two functions that nothing calls:

• startSession (src/api/pkg.ts:62) — POST /v2/request/start
• getSessionJwt (src/api/pkg.ts:83) — GET /v2/request/jwt/{token}

Neither is imported anywhere in src/, tests/, or scripts/, and neither is re-exported from src/index.ts, so they are not part of the public API either. The Yivi flow that would have used them (src/signing/yivi.ts, src/yivi/decrypt-session.ts) drives the session through the yivi-core/yivi-client widgets instead and only calls getUSK / getSigningKeysWithJwt.

Treeshaking keeps them out of dist, so this is source-level debt rather than bundle weight — but they still read as live PKG endpoints a maintainer might rely on.

Remove both functions, plus the SessionStartResult type and any imports that become unused as a result. Keep getUSK, getSigningKeysWithJwt, and fetchMPK.

[dobby-coder]

/dobby fix — delete the unused startSession and getSessionJwt functions from src/api/pkg.ts (lines 62-96) together with the SessionStartResult type and any imports they alone kept alive. Confirm with a grep across src/, tests/, and scripts/ that nothing references them, then run npm run typecheck and npm test. Conventional-commit PR title required.

[dobby-coder]

Got it — I'm on it. I'll remove the unused startSession and getSessionJwt functions from src/api/pkg.ts (lines 62-96), along with the SessionStartResult type and any imports left dangling only for them. I'll grep across src/, tests/, and scripts/ to confirm nothing else references them, then run npm run typecheck and npm test before putting up the PR with a conventional-commit title.

[dobby-coder]

Parked: this is dobby-initiated work coupled to @rubenhensen, who already has 4 dobby PRs waiting for review (budget: 3). I'm not opening another one until some of those merge or close — comment here to re-trigger dobby once there's room.