fix(uds-auth): emergency login workspaces, Desktop key prompts, persistent sessions

Emergency (fallback / sealed-box) admins lost the workspace sidebar and saw
"sign-in failed / add API key" on DSH Desktop because the remote.mux opens
anonymously at boot and every early call was rejected terminally.

- gateway: anonymous workspace/follow reaches dsh-acl's empty baseline;
  anonymous streams are parked until the carrier aborts instead of failing;
  anonymous workspace/initializeDefault answers "nothing created"
- request-auth: a dead UDS_SESSION cookie no longer shadows a valid WS ticket
  or bridge (sync + async variants used by all callers)
- dsh-acl: /api/* waits (bounded 15s) for the gateway ACL during Host startup
  instead of 403, so the Desktop welcome read no longer fails
- desktop-bootstrap: key/account projection is best-effort per reference
- client: emit connection/reset after login so boot-time caches (settings
  describe mirror -> Settings > Models) re-read under the real principal
- sessions: absolute lifetime fixed at 7 days (was min(ttl, 7d) = 30 min);
  bridge expiry slides with its session; MemoryStore persisted to
  sessions.json (bearer hash only, userData AES-256-GCM sealed)
- README: session lifetime/persistence and DSH compatibility notes

Also includes previously uncommitted uds-auth 0.3.x work in this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

uds-auth/lib/session-acl.js

@@ -4,10 +4,11 @@
  * Used with workspace/cwd checks in dsh-acl.js (owner OR own workspace).
  * Missing owner must NOT deny access by itself (legacy sessions).
  */
-import { readFile, writeFile, mkdir } from 'node:fs/promises'
-import { dirname, resolve } from 'node:path'
+import { readFile } from 'node:fs/promises'
+import { resolve } from 'node:path'
 import { getUserContext } from './context.js'
 import { ROLES, computePermissions } from './roles.js'
+import { atomicWriteJson } from './utils/atomic-write.js'
 
 export class SessionAclStore {
   /**
@@ -29,12 +30,17 @@ export class SessionAclStore {
         this._owners.set(String(sessionId), String(empNo))
       }
     } catch (err) {
-      if (err.code !== 'ENOENT') {
-        console.warn('[uds-auth:SessionAcl] load failed:', err.message)
-      }
+      if (err.code === 'ENOENT') return
+      // R09: corrupt ownership must fail closed — do not treat as empty/unowned.
+      console.error('[uds-auth:SessionAcl] load failed — fail closed:', err.message)
+      this._loadFailed = true
     }
   }
 
+  get loadFailed() {
+    return !!this._loadFailed
+  }
+
   _markDirty() {
     this._dirty = true
     if (this._saveTimer) return
@@ -46,16 +52,12 @@ export class SessionAclStore {
     if (!this._dirty || !this._ownersFile) return
     this._dirty = false
     try {
-      await mkdir(dirname(this._ownersFile), { recursive: true })
-      await writeFile(
-        this._ownersFile,
-        JSON.stringify({
-          owners: Object.fromEntries(this._owners),
-          savedAt: new Date().toISOString(),
-        }, null, 2),
-        'utf-8',
-      )
+      await atomicWriteJson(this._ownersFile, {
+        owners: Object.fromEntries(this._owners),
+        savedAt: new Date().toISOString(),
+      }, { mode: 0o600 })
     } catch (err) {
+      this._dirty = true
       console.warn('[uds-auth:SessionAcl] save failed:', err.message)
     }
   }
@@ -64,10 +66,21 @@ export class SessionAclStore {
     return this._owners.get(String(sessionId)) || null
   }
 
-  setOwner(sessionId, empNo) {
-    if (!sessionId || !empNo) return
-    this._owners.set(String(sessionId), String(empNo))
+  /**
+   * Stamp owner. Existing foreign owner is NOT overwritten unless force=true (SEC-13).
+   * @returns {boolean} true if written / already same owner
+   */
+  setOwner(sessionId, empNo, { force = false } = {}) {
+    if (!sessionId || !empNo) return false
+    const id = String(sessionId)
+    const next = String(empNo)
+    const existing = this._owners.get(id)
+    if (existing && String(existing) !== next && !force) {
+      return false
+    }
+    this._owners.set(id, next)
     this._markDirty()
+    return true
   }
 
   /** All stamped owners for export / analytics. */