Roster never fakes a followed star

GET /api/v1/following only lists real Follow rows after bearer auth. A 401 does not mint username.

Kumir never invents a successful follow stamp. GET /api/following and GET /api/v1/following only return real Follow rows after a signed-in session.

A 401 does not mint starId or username. Topics stay on /following/topics — the roster remains bearer.