feat: harden support, localize knowledge and add operator availability [skip ci]

Source-only publication of reviewed commit 64e96a7f423673dc29ad56485be9fc79bce8af1c.

Passed in isolation: focused frontend/backend tests, race checks, TypeScript typecheck, lint, Go compilation, Flowgram build, and deterministic SDK build/tests.

Not accepted as a production release: Next.js export/native assembly remains blocked by environment memory limits; browser interaction and MySQL staging acceptance remain unverified. No production server, database/schema, runtime configuration, deployment, release tag, or workflow execution was performed.

Expected source tree: 0a4a7528e9.

internal/handlers/api/customer_handler.go

@@ -1,7 +1,13 @@
+// Modified in the independent hardening fork; see docs/hardening.
+
 package api
 
 import (
+	"time"
+
 	"agent-desk/internal/pkg/config"
+	"agent-desk/internal/pkg/dto/response"
+	"agent-desk/internal/pkg/enums"
 	"agent-desk/internal/pkg/httpx"
 	"agent-desk/internal/pkg/openidentity"
 	"agent-desk/internal/services"
@@ -17,10 +23,11 @@ func CustomerPostSession_exchange(ctx *gin.Context) {
 	}
 	identity := config.Current().Identity
 	externalUser, err := openidentity.GetExternalUser(ctx, openidentity.Secrets{
-		UserToken:      services.ChannelService.GetUserTokenSecret(channel),
-		IdentityHMAC:   identity.Secret,
-		IdentityMaxAge: identity.MaxAge(),
-		ChannelID:      channel.ChannelID,
+		UserToken:             services.ChannelService.GetUserTokenSecret(channel),
+		IdentityHMAC:          identity.Secret,
+		IdentityMaxAge:        identity.MaxAge(),
+		ChannelID:             channel.ChannelID,
+		RequireSignedIdentity: services.ChannelService.RequiresSignedIdentity(channel),
 	})
 	if err != nil {
 		httpx.WriteJSON(ctx, err)
@@ -33,3 +40,29 @@ func CustomerPostSession_exchange(ctx *gin.Context) {
 	}
 	httpx.WriteJSON(ctx, resp)
 }
+
+// Refresh requires possession of the still-valid customer credential; unlike
+// unsigned session exchange it never creates or changes an anonymous identity.
+func CustomerPostSession_refresh(ctx *gin.Context) {
+	channel := services.ChannelService.GetEnabledChannel(ctx)
+	if channel == nil {
+		httpx.WriteJSON(ctx, httpx.JsonErrorMsg(ctx, "error.e0209"))
+		return
+	}
+	result, err := services.CustomerSessionService.VerifyRequest(ctx, channel)
+	if err != nil {
+		httpx.WriteJSON(ctx, err)
+		return
+	}
+	services.CustomerSessionService.SetRefreshHeaders(ctx, result)
+	source := "guest:"
+	if result.ExternalUser.ExternalSource == enums.ExternalSourceUser {
+		source = "user:"
+	}
+	httpx.WriteJSON(ctx, &response.CustomerSessionExchangeResponse{
+		CustomerSessionToken: result.Token,
+		ExpiresAt:            result.ExpiresAt.UTC().Format(time.RFC3339),
+		IdentityKey:          source + result.ExternalUser.ExternalID,
+		Customer:             response.CustomerSessionCustomerResponse{ID: result.CustomerID, Name: result.ExternalUser.ExternalName},
+	})
+}