Update api.spec.ts - #3316

GSSoC Label Checklist 🏷️

@Priyanshu-byte-coder — please apply the appropriate labels before merging:

Difficulty (pick one):

• level:beginner — 20 pts
• level:intermediate — 35 pts
• level:advanced — 55 pts
• level:critical — 80 pts

Quality (optional):

• quality:clean — ×1.2 multiplier
• quality:exceptional — ×1.5 multiplier

Validation (required to score):

• gssoc:approved — counts for points
• gssoc:invalid / gssoc:spam / gssoc:ai-slop — does not score

Type labels (type:*) are auto-detected from files and title. Review and adjust if needed.
Points formula: (difficulty × quality_multiplier) + type_bonus

What does the salt addition fix? As far as I can tell it's a no-op.

In this version of next-auth, JWTEncodeParams.salt is documented as: "When no salt is passed, we assume this is a session token." Since "next-auth.session-token" is exactly that default, passing it explicitly produces the same token as omitting it. The visual-regression suite encodes a session cookie the same way without salt and authenticates fine.

If it's fixing an actual failure you hit, I'd like to merge it — just add a line to the description saying what broke, because the diff doesn't show it. If it's defensive explicitness, that's a fair argument too, but say so.

The trailing-newline fix at the end of the file is a straightforward improvement either way.