Harden beta adopter recovery and release truth

[jremick]

Summary

• restore the documented dependency gate by moving the production and development lockfile graphs off their high-severity advisories
• keep session authentication read-only during normal requests, move expiry cleanup to session creation, and validate server port/sync interval bounds
• add bounded, typed client failures plus an explicit unavailable state with Retry, while preserving known-good sessions during transient focus/visibility refresh failures
• reconcile beta.1 documentation with the published evidence ledger and record the hardening work under Unreleased

Why this tranche

The published beta.1 remains immutable. Current main had a newly failing high-severity dependency audit, request-time session lookup could block behind SQLite writers, server bootstrap failures were not recoverable in the browser, and the checked-in release contract overstated the broader evidence actually used for beta.1. This PR fixes those adopter-facing and release-gate risks without rebuilding historical evidence machinery or mutating live validation infrastructure.

Verification

• npm audit --audit-level=high — zero vulnerabilities
• npm audit --omit=dev --audit-level=high — zero vulnerabilities
• clean npm ci, then npm run verify:release — 49 test files / 751 tests, builds, recommendation evaluations, packaging checks, and disposable container smoke all passed
• local in-app browser verification — healthy desktop and 390px layouts, API-unavailable state, Retry recovery without reload, and zero application console errors
• independent correctness, security, testing, standards, and adversarial reviews

Release boundary and remaining risks

• does not change the protected v0.1.0-beta.1 tag, released source, released OCI digest, GitHub prerelease, EXP, or household Plex/Seerr state
• issue v0.1.0-beta.1 release evidence and follow-up ledger #32 remains open and authoritative for its six broader beta-hardening evidence rows
• beta.2 candidate enablement still needs version-generalized validators/release parity and a direct beta.1-to-beta.2 upgrade smoke before publication
• dedicated Plex/Seerr state reconciliation, production-sized native responsiveness, the full supported-browser matrix, networkless catalog evidence, and the privacy-reviewed manual artifact remain future beta work
• search cancellation and embedding warmup disconnect/single-flight behavior remain bounded follow-ups; the official beta image continues to use the documented AI-off policy

Refs #32