fix: harden identity, live access, drafts and setup (review only)

Source-reviewed hardening changes and regression tests. UNBUILT / UNTESTED: not a deployable release. Go formatting, compilation, automated regression tests, full frontend validation and staging acceptance remain required. See docs/hardening/VALIDATION.md. Main remains the original clean snapshot; no upstream Git history imported.

web/lib/session-request-guard.ts

@@ -0,0 +1,20 @@
+// Kept transport-independent so all late session completions use the same rule.
+export type SessionIdentity = {
+  accessToken: string
+  user: { id: number }
+}
+
+export function isSameSession(expected: SessionIdentity | null, current: SessionIdentity | null) {
+  return Boolean(expected && current && expected.accessToken === current.accessToken && expected.user.id === current.user.id)
+}
+
+export function createSessionRequestGuard(readCurrent: () => SessionIdentity | null) {
+  let generation = 0
+  return {
+    invalidate() { generation += 1 },
+    begin(session: SessionIdentity) {
+      const requestGeneration = ++generation
+      return () => generation === requestGeneration && isSameSession(session, readCurrent())
+    },
+  }
+}