[codeandsolder]

Follow-up authentication hardening after the CI migration landed.

Changes:

• rotate any existing pre-authentication session ID before attaching authenticated state
• explicitly persist the rotated authenticated session while compensation is still possible
• if session rotation, insertion, or save fails, remove the just-created refresh credential before returning the error
• if explicit session persistence fails, clear pending authenticated in-memory session state so outer middleware cannot later persist the failed login transition
• add an integration regression that captures a pre-authentication cookie, logs in with it, verifies a new session ID is issued, verifies the exact old cookie no longer carries authenticated state, and verifies the rotated cookie does
• add a refresh-token replay regression that rotates twice, replays the exact original token, and proves the still-active descendant family is revoked

The tests deliberately exercise stale credentials rather than only checking replacement responses.

Validation: current head 941840c230dbb0ac340ce03b12ed3ef8dba452f2 passed the complete GitHub Actions matrix in run #85, including Clippy, unit tests, browser/integration E2E, session-fixation and refresh-replay regressions, production builds, WASM checks, audit, lockfile validation, and all Docker images.

The implementation is ready for review and is intentionally not auto-merged. The PR remains draft because the ready-for-review connector mutation is currently unavailable.