chore: sync the frontend template from 4dc033c to 8157ad4

The product was materialized from the template at `4dc033c` and has stayed
on it through 43 template commits, so it was missing all three rounds of
adapter remediation — including files it never had, such as the shared
`abortable-operation` primitive and the `exact-snapshot` decoder that
later fixes are written against. Taking only the newest round was not
possible for that reason: the delta is coherent only as a whole.

The product had not touched `src/adapters` at all since materialization,
so the 140-file delta applied with a three-way merge and no conflicts.
`package.json` was the single overlap and merged cleanly: the product owns
`name`, the template contributed `check:adapter-inventory`,
`check:remediation-ledger` and the image-resolve-signal type fixture.
All 24 product-owned files — README, index.html, CI workflow, i18n
catalog, home page, generated schemas, evidence scripts, component and
visual snapshots — are byte-identical to `main`.

`template.lock.json` now pins the synced revision and tree.

Verified in this repository, not inherited from the template: six type
projects, lint, nine gates (adapter inventory, remediation ledger,
registries, diagnostics, realtime boundaries, architecture, browser
file/storage boundaries, optional recipes, documentation), the production
build, and 2,054 of 2,073 tests. The 19 failures are all in
`tests/unit/ci-artifact-contract.test.ts` and are the same pre-existing
sandbox RLIMIT, EMFILE, umask and `/tmp` permission behaviour the template
records; four suites that failed once under parallel load pass in
isolation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/application/ports/auth-session-port.ts

@@ -9,7 +9,16 @@ export type SessionGateway = Readonly<{
   subscribe(listener: () => void): () => void;
   beginSignIn(returnTo?: string): Promise<void>;
   signOut(): Promise<void>;
-  recover(): Promise<"restored" | "no-session">;
+  /**
+   * LEG-01. Recovery is part of a request's lifetime, so it receives the same
+   * context a credential attach does. The context is optional for one release
+   * to keep existing owners working; the transport races the signal either way,
+   * and a recovery that answers after the request already ended is observed but
+   * never turned into a user-visible sign-out.
+   */
+  recover(
+    context?: CredentialOperationContext,
+  ): Promise<"restored" | "no-session">;
 }>;
 
 export type CredentialRequestBinding = Readonly<{
@@ -22,8 +31,21 @@ export type CredentialPatch = Readonly<{
   headers: Readonly<Record<string, string>>;
 }>;
 
+/**
+ * §8.5. The transport lifetime handed to a credential owner. A cooperative
+ * owner abandons its own work on abort; a non-cooperative one is still bounded
+ * because the transport races the same signal.
+ */
+export type CredentialOperationContext = Readonly<{
+  signal: AbortSignal;
+  deadlineAtMonotonicMs: number;
+}>;
+
 export type CredentialAttacher = Readonly<{
-  credentialPatch(binding: CredentialRequestBinding): Promise<CredentialPatch>;
+  credentialPatch(
+    binding: CredentialRequestBinding,
+    context?: CredentialOperationContext,
+  ): Promise<CredentialPatch>;
   onUnauthenticated(): void;
 }>;