Polish the endpoint-less sessionAuth warning: attribute injected onChallenge, decide null handling

[garretpremo]

Spawned from #149 (non-blocking review observations). Small diagnostic-polish items on the sessionAuth warning in src/auth/refresh-wiring.ts — neither is a correctness bug.

1. Found: onChallenge names a key the user never wrote

bin/apijack.ts:130-132 and src/run-routine.ts:140-142 inject onChallenge into the sessionAuth object when a project exports the hook from .apijack/auth.ts. A project with a deliberate sessionAuth: { refreshOn: [401] } block and a custom onChallenge therefore sees:

[apijack] sessionAuth is set but missing session.endpoint — SessionAuthStrategy will not be used. Found: onChallenge.

Keeping the warning is correct and was decided deliberately in #148: onChallenge is consumed only by SessionAuthStrategy, which is never constructed without an endpoint, so the hook really is dead in that config. The problem is purely presentational — the user wrote refreshOn in one file and an onChallenge export in another, and the message names a key that appears in neither of the places they'd look.

Suggested: attribute the injected key, e.g. Found: onChallenge (injected from .apijack/auth.ts).

2. foundKeys treats an explicit null as present

The filter is key !== 'refreshOn' && value !== undefined, so a JSON env config with "cookies": null counts as a found key and gets named. Arguably correct — an explicit null is still something the user typed — but it's a different notion of "present" than the undefined case the filter was written for, and it's untested either way. Worth deciding and pinning.

Acceptance criteria

• The warning distinguishes a framework-injected onChallenge from keys the user wrote into the sessionAuth block
• Explicit-null handling in foundKeys is decided deliberately and covered by a test
• The session.endpoint warning fires for a deliberate refreshOn-only sessionAuth block #148 behavior is otherwise unchanged: refreshOn-only is silent, the typo'd-handshake-key case still warns