refactor(ui): inject the session server-side instead of fetching it client-side

The pages are rendered by the server, which already holds the session — so
/fingerprint, /cropper and the landing now embed window.__SESSION__ (JSON,
with '<' escaped) instead of each fetching /auth/session on load:

- /fingerprint gets token, identity, agentUrl and the permitted domains
  (the same cached context the endpoint returned); /cropper gets identity
- landing nav is now server-rendered (Sign in vs user chip + Sign out);
  its client fetch script is deleted
- per-user HTML is sent with Cache-Control: no-store and Vary: Cookie
- express.static runs with index:false so '/' can be session-aware while
  assets stay session-free
- GET /auth/session remains as the documented JSON contract (and the
  canonical place the domain-filter caching is exercised in tests)

Client code shrinks by a fetch + error path per page; 3 new tests
(injection, escaping, landing header) — 43 total.

tools/test/cropper.test.js

@@ -230,7 +230,9 @@ test('crop gate: permitted operator loads the page; denied operator does not', a
     const cookies = await login(ok.base);
     const page = await fetch(`${ok.base}/cropper`, { headers: { cookie: cookies } });
     assert.equal(page.status, 200);
-    assert.match(await page.text(), /Smart Photo Editor|Image Cropper/);
+    const html = await page.text();
+    assert.match(html, /Smart Photo Editor|Image Cropper/);
+    assert.match(html, /window\.__SESSION__ = \{/, 'session injected server-side');
   } finally {
     await ok.stop();
   }