fix: harden identity, live access, drafts and setup (review only)

Source-reviewed hardening changes and regression tests. UNBUILT / UNTESTED: not a deployable release. Go formatting, compilation, automated regression tests, full frontend validation and staging acceptance remain required. See docs/hardening/VALIDATION.md. Main remains the original clean snapshot; no upstream Git history imported.

internal/services/ws_connection_manager.go

@@ -1,3 +1,5 @@
+// Modified in the independent hardening fork; see docs/hardening.
+
 package services
 
 import "sync"
@@ -23,6 +25,7 @@ func (m *WsConnectionManager) Register(session *ClientSession, defaultTopics []s
 	m.mu.Lock()
 	defer m.mu.Unlock()
 
+	if session.Closed.Load() { return len(m.sessions) }
 	m.sessions[session.ID] = session
 	for _, topic := range defaultTopics {
 		m.subscribeLocked(session, topic)
@@ -53,6 +56,7 @@ func (m *WsConnectionManager) Subscribe(session *ClientSession, topics []string)
 	m.mu.Lock()
 	defer m.mu.Unlock()
 
+	if session.Closed.Load() { return nil }
 	ret := make([]string, 0, len(topics))
 	for _, topic := range topics {
 		if _, exists := session.Topics[topic]; exists {
@@ -132,3 +136,12 @@ func (m *WsConnectionManager) unsubscribeLocked(session *ClientSession, topic st
 	}
 	delete(session.Topics, topic)
 }
+
+func (m *WsConnectionManager) TopicList(session *ClientSession) []string {
+ m.mu.RLock()
+ defer m.mu.RUnlock()
+ if session == nil { return nil }
+ topics := make([]string, 0, len(session.Topics))
+ for topic := range session.Topics { topics = append(topics, topic) }
+ return topics
+}