VAN-7715: add host session lifecycle boundary

[kishanPBB]

Change

Pending account work must stop when a session expires, is refreshed, signs out, or changes accounts. Add a host-only session client that invalidates outstanding leases and ignores stale responses. Failed logout reports an unavailable session rather than claiming the server revoked it.

The client uses fixed same-origin HTTPS cookie-backed endpoints, bounded responses, strict session payloads, redacted errors and an in-memory CSRF token. It exposes no account credentials through game contracts and adds no runtime dependencies.

Scope

First implementation slice of VAN-7715. This does not complete login/signup: private session endpoints, provider registration, native identity handoff, cross-tab notifications, catalog UI and staging verification remain. Cloud migration/sync remain separate work under VAN-7465. Documentation specifies the required server guarantees, including account binding of writes; client abort alone cannot undo a server commit.

Validation

• 162 unit tests passed, including 10 new session lifecycle/security cases.
• Public API type checks, ESLint, formatting and public-tree checks passed.
• All 12 existing browser tests passed with installed Chrome (11 catalog/save cases plus the packaged-release case after generating the catalog artifact).
• No deployment or production configuration changes.