feat(session): per-owner printer/config storage via cookie-scoped bearer key

Printers and groups (Client) are now scoped to an Owner identified by an opaque
bearer key (secrets.token_urlsafe(32)) stored in an httponly cookie, defaulting
to temporary. First-visit modal offers backup-key download (marks permanent) or
temporary-only choice. /session/restore re-attaches a fresh browser to a saved
key. Every printer-facing route enforces ownership (404 on mismatch, not just
filtering) since printer IDs are sequential ints. Drivers stay global/shared.

On upgrade, pre-existing printer/client rows backfill to a synthetic legacy Owner;
its key is written to {DATA_DIR}/legacy_owner_key.txt for manual restore.

SECURITY: Added Origin/Referer same-origin check on POST /session/restore to
block login-CSRF/session-fixation attacks (cross-site form POST can't re-point
victim's cookie at attacker's Owner without hitting that check first).

Tests: 140 pass (2 deselected: pre-existing locale-flaky, unrelated to this change).
Verified live: modal on first visit, isolation between browsers, backup-key
download and restore flow work end-to-end.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

imptune/api/icons.py

@@ -5,7 +5,7 @@ import hashlib
 import io
 from pathlib import Path
 
-from fastapi import APIRouter, UploadFile
+from fastapi import APIRouter, Request, UploadFile
 from fastapi.responses import HTMLResponse
 from PIL import Image
 
@@ -18,7 +18,7 @@ MAX_ICON_BYTES = 750 * 1024  # 750 KB
 
 
 @router.post("/{printer_id}/icon", response_class=HTMLResponse)
-def upload_icon(printer_id: int, file: UploadFile) -> HTMLResponse:
+def upload_icon(request: Request, printer_id: int, file: UploadFile) -> HTMLResponse:
     """Accept a printer icon PNG, validate it, store it, and update the Icon record.
 
     Validation rules:
@@ -29,8 +29,10 @@ def upload_icon(printer_id: int, file: UploadFile) -> HTMLResponse:
     Replaces any previously uploaded icon for this printer.
     Returns an HTMX-friendly HTML fragment.
     """
-    # Check printer exists
-    printer = Printer.get_or_none(Printer.id == printer_id)
+    # Check printer exists and belongs to this owner
+    printer = Printer.get_or_none(
+        (Printer.id == printer_id) & (Printer.owner == request.state.owner)
+    )
     if printer is None:
         return HTMLResponse(
             content="<p>Printer not found.</p>",