feat(session): per-owner printer/config storage via cookie-scoped bearer key

Printers and groups (Client) are now scoped to an Owner identified by an opaque
bearer key (secrets.token_urlsafe(32)) stored in an httponly cookie, defaulting
to temporary. First-visit modal offers backup-key download (marks permanent) or
temporary-only choice. /session/restore re-attaches a fresh browser to a saved
key. Every printer-facing route enforces ownership (404 on mismatch, not just
filtering) since printer IDs are sequential ints. Drivers stay global/shared.

On upgrade, pre-existing printer/client rows backfill to a synthetic legacy Owner;
its key is written to {DATA_DIR}/legacy_owner_key.txt for manual restore.

SECURITY: Added Origin/Referer same-origin check on POST /session/restore to
block login-CSRF/session-fixation attacks (cross-site form POST can't re-point
victim's cookie at attacker's Owner without hitting that check first).

Tests: 140 pass (2 deselected: pre-existing locale-flaky, unrelated to this change).
Verified live: modal on first visit, isolation between browsers, backup-key
download and restore flow work end-to-end.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

imptune/api/printers.py

@@ -33,9 +33,11 @@ def _render_printer_list(request: Request) -> HTMLResponse:
     """Query printers with LEFT JOIN on client and render grouped partial."""
     import json
 
+    owner = request.state.owner
     query = (
         Printer.select(Printer, Client)
         .join(Client, JOIN.LEFT_OUTER)
+        .where(Printer.owner == owner)
         .order_by(Client.name, Printer.name)
     )
     grouped: dict[str, list[Printer]] = defaultdict(list)
@@ -43,7 +45,7 @@ def _render_printer_list(request: Request) -> HTMLResponse:
         client_name = p.client.name if p.client_id else "Unassigned"
         grouped[client_name].append(p)
 
-    clients = list(Client.select().order_by(Client.name))
+    clients = list(Client.select().where(Client.owner == owner).order_by(Client.name))
     all_drivers = list(Driver.select().order_by(Driver.uploaded_at.desc()))
     driver_data = [
         {"driver": d, "names": json.loads(d.driver_desc) if d.driver_desc else []}
@@ -94,8 +96,13 @@ def create_printer(
     color_mode_bool = color_mode == "on"
     collate_bool = collate == "on"
 
-    # Resolve optional FK IDs
+    owner = request.state.owner
+
+    # Resolve optional FK IDs — client must belong to this owner
     client_fk = int(client_id) if client_id.strip() else None
+    if client_fk is not None:
+        if Client.get_or_none((Client.id == client_fk) & (Client.owner == owner)) is None:
+            return _error_response(f"Client {client_fk} not found.", status_code=404)
     driver_fk = int(driver_id) if driver_id.strip() else None
 
     Printer.create(
@@ -106,6 +113,7 @@ def create_printer(
         color_mode=color_mode_bool,
         paper_size=paper_size,
         collate=collate_bool,
+        owner=owner,
         client=client_fk,
         driver=driver_fk,
     )
@@ -116,7 +124,11 @@ def create_printer(
 @router.delete("/{printer_id}", response_class=HTMLResponse)
 def delete_printer(request: Request, printer_id: int) -> HTMLResponse:
     """Delete a printer by ID. Returns updated printer list partial."""
-    deleted = Printer.delete().where(Printer.id == printer_id).execute()
+    deleted = (
+        Printer.delete()
+        .where((Printer.id == printer_id) & (Printer.owner == request.state.owner))
+        .execute()
+    )
     if not deleted:
         return _error_response(f"Printer {printer_id} not found.", status_code=404)
 
@@ -140,7 +152,8 @@ def update_printer(
     """Update an existing printer configuration in-place."""
     from datetime import UTC, datetime
 
-    printer = Printer.get_or_none(Printer.id == printer_id)
+    owner = request.state.owner
+    printer = Printer.get_or_none((Printer.id == printer_id) & (Printer.owner == owner))
     if printer is None:
         return _error_response(f"Printer {printer_id} not found.", status_code=404)
 
@@ -159,6 +172,11 @@ def update_printer(
     if paper_size not in _VALID_PAPER:
         return _error_response(f"Invalid paper size: {paper_size}.")
 
+    client_fk = int(client_id) if client_id.strip() else None
+    if client_fk is not None:
+        if Client.get_or_none((Client.id == client_fk) & (Client.owner == owner)) is None:
+            return _error_response(f"Client {client_fk} not found.", status_code=404)
+
     printer.name = name
     printer.ip_address = ip_address
     printer.port_name = port_name
@@ -166,7 +184,7 @@ def update_printer(
     printer.color_mode = color_mode == "on"
     printer.paper_size = paper_size
     printer.collate = collate == "on"
-    printer.client = int(client_id) if client_id.strip() else None
+    printer.client = client_fk
     printer.driver = int(driver_id) if driver_id.strip() else None
     printer.updated_at = datetime.now(UTC).replace(tzinfo=None)
     printer.save()