fix: harden identity, live access, drafts and setup (review only)

Source-reviewed hardening changes and regression tests. UNBUILT / UNTESTED: not a deployable release. Go formatting, compilation, automated regression tests, full frontend validation and staging acceptance remain required. See docs/hardening/VALIDATION.md. Main remains the original clean snapshot; no upstream Git history imported.

internal/pkg/dto/dto.go

@@ -1,6 +1,11 @@
+// Modified in the independent hardening fork; see docs/hardening.
+
 package dto
 
-import "agent-desk/internal/pkg/enums"
+import (
+	"agent-desk/internal/pkg/enums"
+	"time"
+)
 
 type AuthPrincipal struct {
 	UserID      int64
@@ -11,16 +16,22 @@ type AuthPrincipal struct {
 	Status      enums.Status
 	Roles       []string
 	Permissions []string
+
+	// Session metadata stays internal and binds long-lived connections to the
+	// original login session and its absolute deadline.
+	LoginSessionID int64     `json:"-"`
+	ExpiresAt      time.Time `json:"-"`
 }
 
 type WebChannelConfig struct {
-	Title           string   `json:"title"`
-	Subtitle        string   `json:"subtitle"`
-	ThemeColor      string   `json:"themeColor"`
-	Position        string   `json:"position"`
-	Width           string   `json:"width"`
-	UserTokenSecret string   `json:"userTokenSecret,omitempty"`
-	PromptStarters  []string `json:"promptStarters,omitempty"`
+	Title                 string   `json:"title"`
+	Subtitle              string   `json:"subtitle"`
+	ThemeColor            string   `json:"themeColor"`
+	Position              string   `json:"position"`
+	Width                 string   `json:"width"`
+	UserTokenSecret       string   `json:"userTokenSecret,omitempty"`
+	RequireSignedIdentity bool     `json:"requireSignedIdentity,omitempty"`
+	PromptStarters        []string `json:"promptStarters,omitempty"`
 }
 
 type TelegramChannelConfig struct {

internal/pkg/dto/request/setup_readiness_req.go

@@ -1,3 +1,4 @@
+// Modified in AgentDeskFixes: safe, reviewed setup repairs and honest routing diagnostics.
 package request
 
 type SetupSimulateRouteRequest struct {
@@ -8,4 +9,6 @@ type SetupSimulateRouteRequest struct {
 type SetupQuickFixRequest struct {
 	Action   string `json:"action" form:"action"`
 	EntityID int64  `json:"entity_id" form:"entity_id"`
+	Apply bool `json:"apply" form:"apply"`
+	PreviewToken string `json:"preview_token" form:"preview_token"`
 }

internal/pkg/dto/response/setup_readiness_resp.go

@@ -1,3 +1,4 @@
+// Modified in AgentDeskFixes: safe, reviewed setup repairs and honest routing diagnostics.
 package response
 
 type SetupIssueItem struct {
@@ -92,7 +93,20 @@ type SetupSimulateRouteResponse struct {
 	CandidateOperators []SimulatedOperatorCandidate `json:"candidate_operators"`
 }
 
-type SetupQuickFixResponse struct {
-	AppliedActions []string               `json:"applied_actions"`
-	Readiness      SetupReadinessResponse `json:"readiness"`
+type SetupQuickFixChange struct {
+ EntityType string `json:"entity_type"`
+ EntityID int64 `json:"entity_id"`
+ EntityName string `json:"entity_name"`
+ Operation string `json:"operation"`
+ Before map[string]any `json:"before"`
+ After map[string]any `json:"after"`
+}
+
+type SetupQuickFixResponse struct {
+ Applied bool `json:"applied"`
+ PreviewToken string `json:"preview_token"`
+ Changes []SetupQuickFixChange `json:"changes"`
+ WarningCodes []string `json:"warning_codes"`
+ AppliedActions []string `json:"applied_actions"`
+ Readiness *SetupReadinessResponse `json:"readiness,omitempty"`
 }