fix: harden identity, live access, drafts and setup (review only)

Source-reviewed hardening changes and regression tests. UNBUILT / UNTESTED: not a deployable release. Go formatting, compilation, automated regression tests, full frontend validation and staging acceptance remain required. See docs/hardening/VALIDATION.md. Main remains the original clean snapshot; no upstream Git history imported.

web/lib/realtime-connection.ts

@@ -1,3 +1,4 @@
+// Modified in the independent hardening fork; see docs/hardening/README.md.
 "use client"
 
 export type RealtimeConnectionStatus = "connecting" | "connected" | "disconnected"
@@ -157,15 +158,13 @@ export function createRealtimeConnectionManager(
     })
 
     nextSocket.addEventListener("close", (event) => {
-      clearPingTimer()
       const isCurrentSocket = socket === nextSocket
-      if (isCurrentSocket) {
-        setSocket(null)
-      }
-      options.onClose?.(event, nextSocket)
       if (!isCurrentSocket) {
         return
       }
+      clearPingTimer()
+      setSocket(null)
+      options.onClose?.(event, nextSocket)
       if (canReconnect()) {
         scheduleReconnect()
       } else {
@@ -184,6 +183,9 @@ export function createRealtimeConnectionManager(
   }
 
   const disconnect = (disconnectOptions?: DisconnectOptions) => {
+    // Also invalidate an in-flight beforeConnect, even if another connection
+    // is enabled immediately after this disconnect.
+    connectEpoch += 1
     reconnectEnabled = disconnectOptions?.reconnect ?? false
     clearTimers()
     if (!reconnectEnabled) {