fix: align the legacy and optional network paths with V3 authority

LEG-01. AuthSessionPort.recover now takes the request's lifetime context, and
the raw recovery helper returns data only. The sign-out notification moved to
the site that adopts the result, so a recovery that answers after the deadline
or a caller abort is observed and discarded instead of logging the user out of
a request nobody is waiting on.

LEG-02. The V2 client shares V3's credential admission validator instead of
checking the allowed set alone. A bearer profile whose patch omits, empties,
duplicates or corrupts Authorization now fails closed with zero fetches rather
than dispatching an anonymous request under an authenticated profile.

OPT-NET-01. A cursor loader rejection is re-thrown exactly as it is with no
signal at all. Only a signal that has actually aborted classifies the outcome
as PAGINATION_ABORTED, so a real upstream failure stops being filed as a user
cancellation.

OPT-NET-02. defineMutationIntent and the V3 admission site now share the single
isValidIdempotencyKey authority, closing the drift that let a control character
through intent definition.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/adapters/query-cache/cursor-pagination-runtime.ts

@@ -12,6 +12,11 @@ const ABORTED = Symbol("PAGINATION_ABORTED");
  * Resolves as soon as the operation settles or the signal aborts, whichever
  * comes first. A late operation result is observed and discarded, never thrown
  * as an unhandled rejection.
+ *
+ * OPT-NET-01. A loader rejection is *not* an abort. The presence of a signal
+ * says nothing about why the loader failed, so a rejection is re-thrown exactly
+ * as it would be with no signal at all; only a signal that has actually
+ * aborted classifies the outcome as cancellation.
  */
 async function raceAbort<Value>(
   operation: Promise<Value>,
@@ -20,7 +25,7 @@ async function raceAbort<Value>(
   operation.catch(() => {});
   if (!signal) return await operation;
   if (signal.aborted) return ABORTED;
-  return await new Promise<Value | typeof ABORTED>((resolve) => {
+  return await new Promise<Value | typeof ABORTED>((resolve, reject) => {
     const onAbort = () => resolve(ABORTED);
     signal.addEventListener("abort", onAbort, { once: true });
     operation.then(
@@ -28,9 +33,13 @@ async function raceAbort<Value>(
         signal.removeEventListener("abort", onAbort);
         resolve(value);
       },
-      () => {
+      (reason: unknown) => {
         signal.removeEventListener("abort", onAbort);
-        resolve(ABORTED);
+        if (signal.aborted) {
+          resolve(ABORTED);
+          return;
+        }
+        reject(reason);
       },
     );
   });