fix: harden identity, live access, drafts and setup (review only)

Source-reviewed hardening changes and regression tests. UNBUILT / UNTESTED: not a deployable release. Go formatting, compilation, automated regression tests, full frontend validation and staging acceptance remain required. See docs/hardening/VALIDATION.md. Main remains the original clean snapshot; no upstream Git history imported.

internal/repositories/channel_config_repository.go

@@ -0,0 +1,20 @@
+package repositories
+
+import (
+ "agent-desk/internal/models"
+ "agent-desk/internal/pkg/enums"
+ "gorm.io/gorm"
+)
+
+// UpdatesConfigIfUnchanged prevents a stale read/modify/write from replacing a
+// concurrently tightened authentication policy or rotated channel secret. HEX is
+// available in SQLite and MySQL and compares exact bytes even when MySQL's text
+// column uses a case-insensitive or trailing-space-insensitive collation.
+func (r *channelRepository) UpdatesConfigIfUnchanged(db *gorm.DB, expected *models.Channel, columns map[string]any) (bool, error) {
+ if expected == nil || expected.ID <= 0 { return false, nil }
+ result := db.Model(&models.Channel{}).
+  Where("id = ? AND status <> ? AND updated_at = ?", expected.ID, enums.StatusDeleted, expected.UpdatedAt).
+  Where("HEX(COALESCE(config_json, '')) = HEX(?)", expected.ConfigJSON).
+  Updates(columns)
+ return result.RowsAffected == 1, result.Error
+}