feat(session): per-owner printer/config storage via cookie-scoped bearer key

Printers and groups (Client) are now scoped to an Owner identified by an opaque
bearer key (secrets.token_urlsafe(32)) stored in an httponly cookie, defaulting
to temporary. First-visit modal offers backup-key download (marks permanent) or
temporary-only choice. /session/restore re-attaches a fresh browser to a saved
key. Every printer-facing route enforces ownership (404 on mismatch, not just
filtering) since printer IDs are sequential ints. Drivers stay global/shared.

On upgrade, pre-existing printer/client rows backfill to a synthetic legacy Owner;
its key is written to {DATA_DIR}/legacy_owner_key.txt for manual restore.

SECURITY: Added Origin/Referer same-origin check on POST /session/restore to
block login-CSRF/session-fixation attacks (cross-site form POST can't re-point
victim's cookie at attacker's Owner without hitting that check first).

Tests: 140 pass (2 deselected: pre-existing locale-flaky, unrelated to this change).
Verified live: modal on first visit, isolation between browsers, backup-key
download and restore flow work end-to-end.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

imptune/api/scripts.py

@@ -1,18 +1,18 @@
 """Script download endpoints — generates and serves PowerShell scripts for a printer."""
 import json
 
-from fastapi import APIRouter
+from fastapi import APIRouter, Request
 from fastapi.responses import PlainTextResponse
 
-from imptune.db.models import Printer
+from imptune.db.models import Owner, Printer
 from imptune.generators.script_generator import render_detect, render_install, render_uninstall
 
 router = APIRouter(prefix="/printers")
 
 
-def _get_printer_and_driver(printer_id: int):
-    """Fetch printer and validate driver — returns (printer, driver_name) or PlainTextResponse error."""
-    printer = Printer.get_or_none(Printer.id == printer_id)
+def _get_printer_and_driver(printer_id: int, owner: Owner):
+    """Fetch printer (scoped to owner) and validate driver — returns (printer, driver_name) or PlainTextResponse error."""
+    printer = Printer.get_or_none((Printer.id == printer_id) & (Printer.owner == owner))
     if printer is None:
         return None, PlainTextResponse("Printer not found", status_code=404)
 
@@ -35,8 +35,8 @@ def _get_printer_and_driver(printer_id: int):
     return (printer, driver, driver_name), None
 
 
-def _install_response(printer_id: int):
-    result, error = _get_printer_and_driver(printer_id)
+def _install_response(printer_id: int, owner: Owner):
+    result, error = _get_printer_and_driver(printer_id, owner)
     if error is not None:
         return error
     printer, driver, driver_name = result
@@ -57,8 +57,8 @@ def _install_response(printer_id: int):
     )
 
 
-def _uninstall_response(printer_id: int):
-    result, error = _get_printer_and_driver(printer_id)
+def _uninstall_response(printer_id: int, owner: Owner):
+    result, error = _get_printer_and_driver(printer_id, owner)
     if error is not None:
         return error
     printer, driver, driver_name = result
@@ -73,8 +73,8 @@ def _uninstall_response(printer_id: int):
     )
 
 
-def _detect_response(printer_id: int):
-    result, error = _get_printer_and_driver(printer_id)
+def _detect_response(printer_id: int, owner: Owner):
+    result, error = _get_printer_and_driver(printer_id, owner)
     if error is not None:
         return error
     printer, driver, driver_name = result
@@ -86,36 +86,36 @@ def _detect_response(printer_id: int):
 
 
 @router.get("/{printer_id}/scripts/install")
-def get_install_script(printer_id: int):
+def get_install_script(request: Request, printer_id: int):
     """Download the PowerShell install script for a printer."""
-    return _install_response(printer_id)
+    return _install_response(printer_id, request.state.owner)
 
 
 @router.get("/{printer_id}/scripts/install.ps1")
-def get_install_script_ps1(printer_id: int):
+def get_install_script_ps1(request: Request, printer_id: int):
     """Download the PowerShell install script for a printer (.ps1 alias)."""
-    return _install_response(printer_id)
+    return _install_response(printer_id, request.state.owner)
 
 
 @router.get("/{printer_id}/scripts/uninstall")
-def get_uninstall_script(printer_id: int):
+def get_uninstall_script(request: Request, printer_id: int):
     """Download the PowerShell uninstall script for a printer."""
-    return _uninstall_response(printer_id)
+    return _uninstall_response(printer_id, request.state.owner)
 
 
 @router.get("/{printer_id}/scripts/uninstall.ps1")
-def get_uninstall_script_ps1(printer_id: int):
+def get_uninstall_script_ps1(request: Request, printer_id: int):
     """Download the PowerShell uninstall script for a printer (.ps1 alias)."""
-    return _uninstall_response(printer_id)
+    return _uninstall_response(printer_id, request.state.owner)
 
 
 @router.get("/{printer_id}/scripts/detect")
-def get_detect_script(printer_id: int):
+def get_detect_script(request: Request, printer_id: int):
     """Download the PowerShell detection script for a printer."""
-    return _detect_response(printer_id)
+    return _detect_response(printer_id, request.state.owner)
 
 
 @router.get("/{printer_id}/scripts/detect.ps1")
-def get_detect_script_ps1(printer_id: int):
+def get_detect_script_ps1(request: Request, printer_id: int):
     """Download the PowerShell detection script for a printer (.ps1 alias)."""
-    return _detect_response(printer_id)
+    return _detect_response(printer_id, request.state.owner)