fix: harden identity, live access, drafts and setup (review only)

Source-reviewed hardening changes and regression tests. UNBUILT / UNTESTED: not a deployable release. Go formatting, compilation, automated regression tests, full frontend validation and staging acceptance remain required. See docs/hardening/VALIDATION.md. Main remains the original clean snapshot; no upstream Git history imported.

web/lib/session-request-guard.test.mjs

@@ -0,0 +1,32 @@
+import assert from "node:assert/strict"
+import test from "node:test"
+import { createSessionRequestGuard, isSameSession } from "./session-request-guard.ts"
+
+const account = (id, accessToken) => ({ user: { id }, accessToken })
+
+test("late profile success, error, and finally are stale after sign-out", () => {
+  let current = account(1, "test-session-a")
+  const guard = createSessionRequestGuard(() => current)
+  const isCurrent = guard.begin(current)
+  current = null
+  assert.equal(isCurrent(), false)
+})
+
+test("old account and rotated-token responses cannot clear the current session", () => {
+  const previous = account(1, "test-session-a")
+  assert.equal(isSameSession(previous, account(2, "test-session-b")), false)
+  assert.equal(isSameSession(previous, account(1, "test-session-rotated")), false)
+  assert.equal(isSameSession(null, account(1, "test-session-a")), false)
+  assert.equal(isSameSession(previous, previous), true)
+})
+
+test("only the latest profile request can commit, including same-token requests", () => {
+  const current = account(1, "test-session-a")
+  const guard = createSessionRequestGuard(() => current)
+  const first = guard.begin(current)
+  const second = guard.begin(current)
+  assert.equal(first(), false)
+  assert.equal(second(), true)
+  guard.invalidate()
+  assert.equal(second(), false)
+})