feat: harden support, localize knowledge and add operator availability [skip ci]

Source-only publication of reviewed commit 64e96a7f423673dc29ad56485be9fc79bce8af1c.

Passed in isolation: focused frontend/backend tests, race checks, TypeScript typecheck, lint, Go compilation, Flowgram build, and deterministic SDK build/tests.

Not accepted as a production release: Next.js export/native assembly remains blocked by environment memory limits; browser interaction and MySQL staging acceptance remain unverified. No production server, database/schema, runtime configuration, deployment, release tag, or workflow execution was performed.

Expected source tree: 0a4a7528e9.

web/lib/session-request-guard.ts

@@ -0,0 +1,20 @@
+// Kept transport-independent so all late session completions use the same rule.
+export type SessionIdentity = {
+  accessToken: string
+  user: { id: number }
+}
+
+export function isSameSession(expected: SessionIdentity | null, current: SessionIdentity | null) {
+  return Boolean(expected && current && expected.accessToken === current.accessToken && expected.user.id === current.user.id)
+}
+
+export function createSessionRequestGuard(readCurrent: () => SessionIdentity | null) {
+  let generation = 0
+  return {
+    invalidate() { generation += 1 },
+    begin(session: SessionIdentity) {
+      const requestGeneration = ++generation
+      return () => generation === requestGeneration && isSameSession(session, readCurrent())
+    },
+  }
+}