feat: harden support, localize knowledge and add operator availability [skip ci]

Source-only publication of reviewed commit 64e96a7f423673dc29ad56485be9fc79bce8af1c.

Passed in isolation: focused frontend/backend tests, race checks, TypeScript typecheck, lint, Go compilation, Flowgram build, and deterministic SDK build/tests.

Not accepted as a production release: Next.js export/native assembly remains blocked by environment memory limits; browser interaction and MySQL staging acceptance remain unverified. No production server, database/schema, runtime configuration, deployment, release tag, or workflow execution was performed.

Expected source tree: 0a4a7528e9.

internal/services/ws_session_concurrency_test.go

@@ -0,0 +1,34 @@
+package services
+
+import (
+	"sync"
+	"testing"
+)
+
+// Run with -race: close may be triggered independently by revocation, a reader,
+// a writer, or slow-client eviction while broadcasts still hold a session pointer.
+func TestWsConcurrentEnqueueCloseAndSubscribe(t *testing.T) {
+	ws := newWsService()
+	session := &ClientSession{ID: "concurrent", Topics: map[string]struct{}{}, Send: make(chan []byte, 64)}
+	ws.manager.Register(session, []string{"notification:1"})
+	var work sync.WaitGroup
+	for i := 0; i < 8; i++ {
+		work.Add(1)
+		go func() {
+			defer work.Done()
+			for j := 0; j < 100; j++ {
+				session.enqueue([]byte("test"))
+				ws.manager.Subscribe(session, []string{"notification:1"})
+				ws.manager.TopicList(session)
+			}
+		}()
+	}
+	ws.closeSession(session)
+	work.Wait()
+	if !session.Closed.Load() || ws.manager.HasTopic("notification:1") || len(ws.manager.TopicList(session)) != 0 {
+		t.Fatal("closed session was re-registered")
+	}
+	if session.enqueue([]byte("test")) {
+		t.Fatal("closed session accepted a message")
+	}
+}