fix: align the legacy and optional network paths with V3 authority

LEG-01. AuthSessionPort.recover now takes the request's lifetime context, and
the raw recovery helper returns data only. The sign-out notification moved to
the site that adopts the result, so a recovery that answers after the deadline
or a caller abort is observed and discarded instead of logging the user out of
a request nobody is waiting on.

LEG-02. The V2 client shares V3's credential admission validator instead of
checking the allowed set alone. A bearer profile whose patch omits, empties,
duplicates or corrupts Authorization now fails closed with zero fetches rather
than dispatching an anonymous request under an authenticated profile.

OPT-NET-01. A cursor loader rejection is re-thrown exactly as it is with no
signal at all. Only a signal that has actually aborted classifies the outcome
as PAGINATION_ABORTED, so a real upstream failure stops being filed as a user
cancellation.

OPT-NET-02. defineMutationIntent and the V3 admission site now share the single
isValidIdempotencyKey authority, closing the drift that let a control character
through intent definition.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/contracts/mutation-intent.ts

@@ -70,11 +70,11 @@ export function defineMutationIntent(intent: MutationIntent): MutationIntent {
       intent.canonicalInputIdentity,
       MUTATION_INTENT_BOUNDS.canonicalInputIdentityMaxBytes,
     ) ||
+    // OPT-NET-02. Intent definition and executor admission share one key
+    // authority; a second, looser rule here is how a control character reaches
+    // an `Idempotency-Key` header.
     (intent.idempotencyKey !== undefined &&
-      !validBoundedString(
-        intent.idempotencyKey,
-        MUTATION_INTENT_BOUNDS.idempotencyKeyMaxBytes,
-      )) ||
+      !isValidIdempotencyKey(intent.idempotencyKey)) ||
     !Number.isFinite(intent.createdAtMonotonicMs) ||
     intent.createdAtMonotonicMs < 0
   ) {