fix: harden identity, live access, drafts and setup (review only)

Source-reviewed hardening changes and regression tests. UNBUILT / UNTESTED: not a deployable release. Go formatting, compilation, automated regression tests, full frontend validation and staging acceptance remain required. See docs/hardening/VALIDATION.md. Main remains the original clean snapshot; no upstream Git history imported.

web/lib/realtime-log-context.ts

@@ -0,0 +1,9 @@
+/** Never include WebSocket query parameters, userinfo, or arbitrary close reasons in logs. */
+export function realtimeLogContext(url: string) {
+  try {
+    const parsed = new URL(url)
+    return { origin: parsed.origin, path: parsed.pathname }
+  } catch {
+    return { origin: "", path: "" }
+  }
+}