fix: harden identity, live access, drafts and setup (review only)

Source-reviewed hardening changes and regression tests. UNBUILT / UNTESTED: not a deployable release. Go formatting, compilation, automated regression tests, full frontend validation and staging acceptance remain required. See docs/hardening/VALIDATION.md. Main remains the original clean snapshot; no upstream Git history imported.

web/components/support-chat/close-navigation.test.mjs

@@ -1,3 +1,4 @@
+// Modified in the independent hardening fork; see docs/hardening/README.md.
 import assert from "node:assert/strict"
 import test from "node:test"
 import ts from "typescript"
@@ -14,6 +15,7 @@ async function loadCloseNavigation() {
     fileName: "close-navigation.ts",
   })
   const sandbox = {
+    URLSearchParams,
     exports: {},
     module: { exports: {} },
   }
@@ -27,3 +29,10 @@ test("standalone close navigates to the non-bootstrapping closed page", async ()
 
   assert.equal(getStandaloneClosedUrl(), "/support/chat/closed")
 })
+
+test("dismiss and return retain the entry channel without accepting a redirect destination", async () => {
+  const { getStandaloneClosedUrl, getStandaloneChatUrl } = await loadCloseNavigation()
+  const search = "?channelId=help&externalId=visitor&returnUrl=https%3A%2F%2Fexample.org"
+  assert.equal(getStandaloneClosedUrl(search), `/support/chat/closed${search}`)
+  assert.equal(getStandaloneChatUrl(search), `/support/chat${search}`)
+})