fix: harden identity, live access, drafts and setup (review only)

Source-reviewed hardening changes and regression tests. UNBUILT / UNTESTED: not a deployable release. Go formatting, compilation, automated regression tests, full frontend validation and staging acceptance remain required. See docs/hardening/VALIDATION.md. Main remains the original clean snapshot; no upstream Git history imported.

web/lib/test-support/load-typescript-module.mjs

@@ -0,0 +1,28 @@
+import { readFileSync } from "node:fs"
+import vm from "node:vm"
+import ts from "typescript"
+
+/** Runs the real module with explicitly supplied offline transports/dependencies. */
+export function loadTypeScriptModule(url, dependencies, globals = {}) {
+  const { outputText } = ts.transpileModule(readFileSync(url, "utf8"), {
+    compilerOptions: { target: ts.ScriptTarget.ES2022, module: ts.ModuleKind.CommonJS, jsx: ts.JsxEmit.ReactJSX },
+    fileName: url.pathname,
+  })
+  const module = { exports: {} }
+  const require = (name) => {
+    if (!Object.hasOwn(dependencies, name)) throw new Error(`Unmocked dependency: ${name}`)
+    return dependencies[name]
+  }
+  vm.runInNewContext(outputText, { module, exports: module.exports, require, ...globals }, { filename: url.pathname })
+  return module.exports
+}
+
+export function deferred() {
+  let resolve
+  let reject
+  const promise = new Promise((resolvePromise, rejectPromise) => {
+    resolve = resolvePromise
+    reject = rejectPromise
+  })
+  return { promise, resolve, reject }
+}