feat: harden support, localize knowledge and add operator availability [skip ci]

Source-only publication of reviewed commit 64e96a7f423673dc29ad56485be9fc79bce8af1c.

Passed in isolation: focused frontend/backend tests, race checks, TypeScript typecheck, lint, Go compilation, Flowgram build, and deterministic SDK build/tests.

Not accepted as a production release: Next.js export/native assembly remains blocked by environment memory limits; browser interaction and MySQL staging acceptance remain unverified. No production server, database/schema, runtime configuration, deployment, release tag, or workflow execution was performed.

Expected source tree: 0a4a7528e9.

web/lib/api/auth.ts

@@ -1,4 +1,7 @@
+// Modified in the independent hardening fork; see docs/hardening/README.md.
+// Modified for AgentDeskFixes: prevent stale profile updates and logout from modifying a newer session.
 import { clearSession, readSession, writeSession, type AuthSession } from "@/lib/auth"
+import { isSameSession } from "@/lib/session-request-guard"
 import { request } from "@/lib/api/client"
 
 export type LoginRequest = {
@@ -41,17 +44,17 @@ export async function fetchProfile() {
 }
 
 export async function updateProfile(payload: UpdateProfileRequest) {
+  const stored = readSession()
   const data = await request<AuthSession>("/api/auth/profile/update", {
     method: "POST",
     body: JSON.stringify(payload),
   })
-  const stored = readSession()
   const nextSession: AuthSession = {
     ...data,
     accessToken: data.accessToken || stored?.accessToken || "",
     expiresAt: data.expiresAt || stored?.expiresAt,
   }
-  writeSession(nextSession)
+  if (isSameSession(stored, readSession())) writeSession(nextSession)
   return nextSession
 }
 
@@ -65,11 +68,12 @@ export function uploadProfileAvatar(file: File) {
 }
 
 export async function logout() {
+  const stored = readSession()
   try {
     await request("/api/auth/logout", {
       method: "POST",
     })
   } finally {
-    clearSession()
+    if (isSameSession(stored, readSession())) clearSession()
   }
 }