feat: harden support, localize knowledge and add operator availability [skip ci]

Source-only publication of reviewed commit 64e96a7f423673dc29ad56485be9fc79bce8af1c.

Passed in isolation: focused frontend/backend tests, race checks, TypeScript typecheck, lint, Go compilation, Flowgram build, and deterministic SDK build/tests.

Not accepted as a production release: Next.js export/native assembly remains blocked by environment memory limits; browser interaction and MySQL staging acceptance remain unverified. No production server, database/schema, runtime configuration, deployment, release tag, or workflow execution was performed.

Expected source tree: 0a4a7528e9.

web/components/auth-provider.tsx

@@ -1,3 +1,5 @@
+// Modified in the independent hardening fork; see docs/hardening/README.md.
+// Modified for AgentDeskFixes: prevent a late logout from redirecting a newer login.
 "use client"
 
 import {
@@ -11,7 +13,7 @@ import {
 import { usePathname, useRouter } from "next/navigation"
 
 import { SessionProvider, useSession } from "@/components/session-provider"
-import { type AuthSession } from "@/lib/auth"
+import { readSession, type AuthSession } from "@/lib/auth"
 
 type AuthContextValue = {
   session: AuthSession | null
@@ -46,17 +48,23 @@ function DashboardAuthProvider({ children }: { children: ReactNode }) {
     try {
       await endSession()
     } finally {
-      startTransition(() => {
-        router.replace("/dashboard/login")
-      })
+      // A different tab or login flow may have established a new session meanwhile.
+      if (!readSession()) {
+        startTransition(() => {
+          router.replace("/dashboard/login")
+        })
+      }
     }
   }
 
   useEffect(() => {
     if (ready && !session && requiresAuth) {
-      startTransition(() => {
-        router.replace("/dashboard/login")
-      })
+      // A different tab or login flow may have established a new session meanwhile.
+      if (!readSession()) {
+        startTransition(() => {
+          router.replace("/dashboard/login")
+        })
+      }
     }
   }, [ready, requiresAuth, router, session])