[Fix] Session artifact helpers allow non-human metadata reads

[roomote-roomote]

​Opened on behalf of @daniel-lxs. Follow up by mentioning @roomote-roomote, in the web UI, or in Telegram.

What changed

• Enforce the canonical readable-Session policy inside Session artifact path and version helpers before querying artifact metadata.
• Reject deployment-principal auth without a human user while preserving deployment-collaborative direct-link reads for authenticated members.
• Add real-database regression coverage for direct helper calls that previously ignored their auth argument.

Why this change was made

The live tRPC callers already authorize Session reads, but the exported helpers accepted an auth context without enforcing it. Checking again at the data-access boundary prevents direct or future internal callers from bypassing the established Session policy.

Impact

No user-facing behavior change is intended for authorized Session reads. This adds defense in depth without removing the existing caller checks; 31 focused artifact tests, web TypeScript, web ESLint, changed-file formatting/lint, and the full pre-push gates pass.

[roomote-community]

No new code issues found. See task

_{Reviewed 51ca293}