fix: harden identity, live access, drafts and setup (review only)

Source-reviewed hardening changes and regression tests. UNBUILT / UNTESTED: not a deployable release. Go formatting, compilation, automated regression tests, full frontend validation and staging acceptance remain required. See docs/hardening/VALIDATION.md. Main remains the original clean snapshot; no upstream Git history imported.

web/lib/realtime-log-context.test.mjs

@@ -0,0 +1,11 @@
+import assert from "node:assert/strict"
+import test from "node:test"
+import { realtimeLogContext } from "./realtime-log-context.ts"
+
+test("socket diagnostics contain only origin and path, never URL credentials or query", () => {
+  assert.deepEqual(realtimeLogContext("wss://user:password@example.test/api/ws/admin?accessToken=not-a-secret#fragment"), {
+    origin: "wss://example.test",
+    path: "/api/ws/admin",
+  })
+  assert.deepEqual(realtimeLogContext("invalid token-bearing input"), { origin: "", path: "" })
+})