Return the authenticated traveler's open assistant session, creating a new one only when none exists (get-or-create). Repeated calls return the same open session id; a new session is minted only after the previous one is closed. Metadata is applied only when a new session is created and is ignored on reuse. Returns 201 in both cases — id-stability is the contract.