refactor(ui): inject the session server-side instead of fetching it client-side

The pages are rendered by the server, which already holds the session — so
/fingerprint, /cropper and the landing now embed window.__SESSION__ (JSON,
with '<' escaped) instead of each fetching /auth/session on load:

- /fingerprint gets token, identity, agentUrl and the permitted domains
  (the same cached context the endpoint returned); /cropper gets identity
- landing nav is now server-rendered (Sign in vs user chip + Sign out);
  its client fetch script is deleted
- per-user HTML is sent with Cache-Control: no-store and Vary: Cookie
- express.static runs with index:false so '/' can be session-aware while
  assets stay session-free
- GET /auth/session remains as the documented JSON contract (and the
  canonical place the domain-filter caching is exercised in tests)

Client code shrinks by a fetch + error path per page; 3 new tests
(injection, escaping, landing header) — 43 total.

tools/public/assets/fp/app.js

@@ -1,6 +1,7 @@
 /* Fingerprint Agent — enrollment wizard. Captures run through the local
    fpagent binary; artifacts are saved via the app's a2loft proxy. */
 /* global Vue, axios, io, customElements */
+/* window.__SESSION__ is injected server-side by /fingerprint */
 Vue.config.ignoredElements = [/^cds-/];
 
 (function () {
@@ -102,19 +103,17 @@ Vue.config.ignoredElements = [/^cds-/];
       },
 
       loadSession: function () {
-        var self = this;
-        return axios.get('/auth/session').then(function (r) {
-          self.session = r.data;
-          if (self.session.domains.length) self.domain = self.session.domains[0].code;
-          self.loading = false;
-        }).catch(function (err) {
-          if (err.response && err.response.status === 401) {
-            window.location.href = '/auth/login';
-            return;
-          }
-          self.loading = false;
-          self.showNotif('error', 'Session error', 'Could not load your session. Please refresh the page.', true);
-        });
+        // injected by the server when the page was rendered (no round-trip)
+        this.session = window.__SESSION__ || null;
+        if (!this.session) {
+          window.location.href = '/auth/login';
+          return Promise.resolve();
+        }
+        if (this.session.domains && this.session.domains.length) {
+          this.domain = this.session.domains[0].code;
+        }
+        this.loading = false;
+        return Promise.resolve();
       },
 
       refreshDomains: function () {