ra-agent handoff server
  POST /session/new          body: {user,pass,moduleId?,clientId?} -> {sessionId, account}
  GET  /session/:sid         cached account info (no MGS call)
  GET  /handoff[?user=X]     connection form — enter creds to mint a session
  POST /session/:sid/spin    body: { bet? }     -> spin result
  POST /session/:sid/state   (read-only refreshes call)