refactor: remove dead session code

src/beaver_gateway/settings.py

@@ -40,7 +40,11 @@ class Settings(BaseSettings):
     value per gateway since we open one Client total."""
 
     bootstrap_tokens: str = ""
-    """Phase 1.3 seed: ``name1:value1,name2:value2``. Empty = no auth wired yet.
+    """Out-of-band token seed: ``name1:value1,name2:value2``. Empty is
+    fine — DB-issued tokens (admin UI) carry steady-state auth.
 
-    Phase 4 moves tokens into the DB. Until then this is the only source.
+    This env channel layers alongside the DB store and is kept for
+    first-run setup, disaster recovery (admin password lost), and
+    ``examples/`` smoke tests. Bootstrap tokens implicitly carry
+    scope ``"*"`` and never get a ``last_used_at`` stamp (no DB row).
     """