Refactor cookie-mode anonymous history hand-off

[akshatmalik-bruh]

Context

Fixes the issue where the frontend was forced to guess when an anonymous visitor logged into a cookie-authenticated host app by repeatedly polling POST /auth/link and receiving 401 Unauthorized responses. This guessing game resulted in unnecessary network spam, latency, and a fragile dependency on window/cookie events.
fixes #131

What Changed

Implemented Server-Side Opportunistic Hand-off. The server is now the authoritative source of truth for when an authenticated session begins.

Backend (deps.py)

• The frontend now attaches the anonymous visitor pass to every request via the X-Extra-Visitor-Pass header.
• get_principal intercepts this header. If the request has an authenticated session cookie and a visitor pass header, the backend opportunistically calls link_anonymous before serving the request.
• The hand-off is instant, atomic, and idempotent.
• Invalid or already-consumed visitor passes are silently ignored, ensuring authenticated requests are never blocked.

Frontend (tokenSource.ts & AgentChatClient.ts)

• Deleted all cookie-mode identity guessing machinery (identityCheckDirty, cookieSnapshotChanged, forceCheck, and focus/visibility/storage event listeners).
• The widget no longer issues speculative POST /auth/link probes in cookie mode.
• AgentChatClient simply attaches the X-Extra-Visitor-Pass header to every fetch.

Verification

• Added 8 comprehensive regression tests in test_api.py covering all edge cases (immediate login, already-adopted pass, invalid pass, concurrent requests, bearer mode preservation).
• make check passes perfectly (linting, typechecking, and all 57 tests).