fix(test): match getSession URL by suffix, not /getSession path

The PDS endpoint URL is /xrpc/com.atproto.server.getSession —
those are dots before getSession, not slashes, so the previous
includes("/getSession") filter never matched and the Authorization
header assertion silently short-circuited via optional chaining.

tests/auth_verify_test.ts

@@ -52,7 +52,7 @@ Deno.test(
         `Bearer ${makeJwt({ sub: did })}`,
       );
       assertEquals(result, did);
-      const sessionCall = stub.calls.find((c) => c.url.includes("/getSession"));
+      const sessionCall = stub.calls.find((c) => c.url.endsWith("getSession"));
       assertEquals(
         sessionCall?.headers.get("Authorization")?.startsWith("Bearer "),
         true,