Session token fixation detection

Replay a session-token lifecycle to detect fixation. Process an ordered list of events; each is one of ['issue', token], ['auth', token] (privilege elevation / login), or ['use', token]. Rules: an 'issue' registers a token as valid+unauthenticated. An 'auth' on a currently-valid token must ROTATE it: the old token is invalidated and a new token (given as a third element ['auth', old, new]) becomes valid+authenticated; auth on an unknown/invalid token is ignored. A 'use' of a token is SECURE only if the token is currently valid. Crucially, a token that was authenticated without rotation (i.e. the SAME token id appears both before and after auth) is a fixation risk. Return the count of 'use' events that operate on a valid token that was authenticated via proper rotation (old != new) — i.e. count secure authenticated uses.