refactor(ui): inject the session server-side instead of fetching it client-side

The pages are rendered by the server, which already holds the session — so
/fingerprint, /cropper and the landing now embed window.__SESSION__ (JSON,
with '<' escaped) instead of each fetching /auth/session on load:

- /fingerprint gets token, identity, agentUrl and the permitted domains
  (the same cached context the endpoint returned); /cropper gets identity
- landing nav is now server-rendered (Sign in vs user chip + Sign out);
  its client fetch script is deleted
- per-user HTML is sent with Cache-Control: no-store and Vary: Cookie
- express.static runs with index:false so '/' can be session-aware while
  assets stay session-free
- GET /auth/session remains as the documented JSON contract (and the
  canonical place the domain-filter caching is exercised in tests)

Client code shrinks by a fetch + error path per page; 3 new tests
(injection, escaping, landing header) — 43 total.

tools/public/assets/cropper/app.js

@@ -2,6 +2,7 @@
    Identity comes from the YOUreka session; the only operator credential is
    the save-time OTP (required by a2loft). Notifications are Carbon toasts. */
 /* global Vue, axios, Croppa, customElements */
+/* window.__SESSION__ is injected server-side by /cropper */
 Vue.config.ignoredElements = [/^cds-/];
 
 (function () {
@@ -69,17 +70,13 @@ Vue.config.ignoredElements = [/^cds-/];
 
     created: function () {
       var self = this;
-      axios.get('/auth/session').then(function (r) {
-        self.session = r.data;
-        self.loading = false;
-      }).catch(function (err) {
-        if (err.response && err.response.status === 401) {
-          window.location.href = '/auth/login';
-          return;
-        }
-        self.loading = false;
-        self.toast('error', 'Session error', 'Could not load your session. Please refresh the page.');
-      });
+      // injected by the server when the page was rendered (no round-trip)
+      this.session = window.__SESSION__ || null;
+      if (!this.session) {
+        window.location.href = '/auth/login';
+        return;
+      }
+      this.loading = false;
       Promise.all(
         ['cds-button', 'cds-toast', 'cds-toast-item', 'cds-tag'].map(function (n) {
           return customElements.whenDefined(n).catch(function () {});