fix: align the legacy and optional network paths with V3 authority

LEG-01. AuthSessionPort.recover now takes the request's lifetime context, and
the raw recovery helper returns data only. The sign-out notification moved to
the site that adopts the result, so a recovery that answers after the deadline
or a caller abort is observed and discarded instead of logging the user out of
a request nobody is waiting on.

LEG-02. The V2 client shares V3's credential admission validator instead of
checking the allowed set alone. A bearer profile whose patch omits, empties,
duplicates or corrupts Authorization now fails closed with zero fetches rather
than dispatching an anonymous request under an authenticated profile.

OPT-NET-01. A cursor loader rejection is re-thrown exactly as it is with no
signal at all. Only a signal that has actually aborted classifies the outcome
as PAGINATION_ABORTED, so a real upstream failure stops being filed as a user
cancellation.

OPT-NET-02. defineMutationIntent and the V3 admission site now share the single
isValidIdempotencyKey authority, closing the drift that let a control character
through intent definition.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/unit/legacy-and-optional-network-remediation.test.ts

@@ -0,0 +1,149 @@
+import { describe, expect, it, vi } from "vitest";
+
+import { createCursorPaginationRuntime } from "../../src/adapters/query-cache/cursor-pagination-runtime.ts";
+import {
+  defineMutationIntent,
+  isValidIdempotencyKey,
+} from "../../src/contracts/mutation-intent.ts";
+import type {
+  CursorPage,
+  CursorPaginationProfile,
+} from "../../src/contracts/cursor-pagination.ts";
+import type { Result } from "../../src/application/result.ts";
+
+const PROFILE: CursorPaginationProfile = Object.freeze({
+  profileId: "TEST_PAGINATION_V1",
+  maxPages: 3,
+  maxTotalItems: 30,
+  maxEstimatedBytes: 32_768,
+  maxCursorBytes: 512,
+  allowSparsePage: false,
+});
+
+function page(
+  items: readonly number[],
+  nextCursor: string | null,
+): CursorPage<number> {
+  return Object.freeze({
+    items: Object.freeze([...items]),
+    nextCursor,
+    hasMore: nextCursor !== null,
+    snapshotToken: "snapshot-1",
+  });
+}
+
+/**
+ * OPT-NET-01. A loader rejection is evidence about the data source. Reporting
+ * it as `PAGINATION_ABORTED` because a signal merely *exists* erases a real
+ * network or contract failure and files it under a user decision nobody made.
+ */
+describe("OPT-NET-01 cursor pagination abort classification", () => {
+  it("preserves a loader rejection while the signal is still live", async () => {
+    const controller = new AbortController();
+    const runtime = createCursorPaginationRuntime<number>({
+      definitionId: "TEST_PAGINATION",
+      profile: PROFILE,
+      loadPage: async () => {
+        throw new TypeError("upstream exploded");
+      },
+    });
+
+    await expect(
+      runtime.loadAll({ signal: controller.signal }),
+    ).rejects.toThrow("upstream exploded");
+  });
+
+  it("keeps the same rejection when no signal is supplied", async () => {
+    const runtime = createCursorPaginationRuntime<number>({
+      definitionId: "TEST_PAGINATION",
+      profile: PROFILE,
+      loadPage: async () => {
+        throw new TypeError("upstream exploded");
+      },
+    });
+
+    await expect(runtime.loadAll({})).rejects.toThrow("upstream exploded");
+  });
+
+  it("classifies a rejection during a real abort as PAGINATION_ABORTED", async () => {
+    const controller = new AbortController();
+    const runtime = createCursorPaginationRuntime<number>({
+      definitionId: "TEST_PAGINATION",
+      profile: PROFILE,
+      loadPage: async () => {
+        controller.abort();
+        throw new TypeError("cancelled upstream");
+      },
+    });
+
+    const result = await runtime.loadAll({ signal: controller.signal });
+    expect(result.ok).toBe(false);
+    expect(result.ok ? null : result.error.code).toBe("PAGINATION_ABORTED");
+  });
+
+  it("does not admit a page that resolves after the abort", async () => {
+    const controller = new AbortController();
+    const loadPage = vi.fn(
+      async (): Promise<Result<CursorPage<number>>> => {
+        controller.abort();
+        await new Promise((resolve) => setTimeout(resolve, 5));
+        return { ok: true, value: page([1, 2], null) };
+      },
+    );
+    const runtime = createCursorPaginationRuntime<number>({
+      definitionId: "TEST_PAGINATION",
+      profile: PROFILE,
+      loadPage,
+    });
+
+    const result = await runtime.loadAll({ signal: controller.signal });
+    expect(result.ok).toBe(false);
+    expect(result.ok ? null : result.error.code).toBe("PAGINATION_ABORTED");
+  });
+});
+
+/**
+ * OPT-NET-02. One idempotency-key authority. Two validators drift, and the
+ * looser one becomes the way a control character reaches a request header.
+ */
+describe("OPT-NET-02 shared idempotency key validation", () => {
+  const rejected = [
+    "",
+    "   ",
+    "key\nwith-newline",
+    "key\u0000null",
+    "key\u007fdelete",
+    "key\u009fc1",
+    "a".repeat(257),
+  ];
+
+  it("rejects the same values at intent definition and at admission", () => {
+    for (const value of rejected) {
+      expect(isValidIdempotencyKey(value)).toBe(false);
+      expect(() =>
+        defineMutationIntent({
+          intentId: "intent-1",
+          operationId: "OP",
+          canonicalInputIdentity: "identity",
+          idempotencyKey: value,
+          createdAtMonotonicMs: 1,
+        }),
+      ).toThrow(TypeError);
+    }
+  });
+
+  it("accepts the bounded printable and Unicode values both sides allow", () => {
+    for (const value of ["key-1", "a".repeat(256), "키-값", "ключ"]) {
+      expect(isValidIdempotencyKey(value)).toBe(true);
+      expect(
+        defineMutationIntent({
+          intentId: "intent-1",
+          operationId: "OP",
+          canonicalInputIdentity: "identity",
+          idempotencyKey: value,
+          createdAtMonotonicMs: 1,
+        }).idempotencyKey,
+      ).toBe(value);
+    }
+  });
+});