fix: harden identity, live access, drafts and setup (review only)

Source-reviewed hardening changes and regression tests. UNBUILT / UNTESTED: not a deployable release. Go formatting, compilation, automated regression tests, full frontend validation and staging acceptance remain required. See docs/hardening/VALIDATION.md. Main remains the original clean snapshot; no upstream Git history imported.

web/lib/api/auth.ts

@@ -1,4 +1,7 @@
+// Modified in the independent hardening fork; see docs/hardening/README.md.
+// Modified for AgentDeskFixes: prevent stale profile updates and logout from modifying a newer session.
 import { clearSession, readSession, writeSession, type AuthSession } from "@/lib/auth"
+import { isSameSession } from "@/lib/session-request-guard"
 import { request } from "@/lib/api/client"
 
 export type LoginRequest = {
@@ -41,17 +44,17 @@ export async function fetchProfile() {
 }
 
 export async function updateProfile(payload: UpdateProfileRequest) {
+  const stored = readSession()
   const data = await request<AuthSession>("/api/auth/profile/update", {
     method: "POST",
     body: JSON.stringify(payload),
   })
-  const stored = readSession()
   const nextSession: AuthSession = {
     ...data,
     accessToken: data.accessToken || stored?.accessToken || "",
     expiresAt: data.expiresAt || stored?.expiresAt,
   }
-  writeSession(nextSession)
+  if (isSameSession(stored, readSession())) writeSession(nextSession)
   return nextSession
 }
 
@@ -65,11 +68,12 @@ export function uploadProfileAvatar(file: File) {
 }
 
 export async function logout() {
+  const stored = readSession()
   try {
     await request("/api/auth/logout", {
       method: "POST",
     })
   } finally {
-    clearSession()
+    if (isSameSession(stored, readSession())) clearSession()
   }
 }