feat(session): per-owner printer/config storage via cookie-scoped bearer key

Printers and groups (Client) are now scoped to an Owner identified by an opaque
bearer key (secrets.token_urlsafe(32)) stored in an httponly cookie, defaulting
to temporary. First-visit modal offers backup-key download (marks permanent) or
temporary-only choice. /session/restore re-attaches a fresh browser to a saved
key. Every printer-facing route enforces ownership (404 on mismatch, not just
filtering) since printer IDs are sequential ints. Drivers stay global/shared.

On upgrade, pre-existing printer/client rows backfill to a synthetic legacy Owner;
its key is written to {DATA_DIR}/legacy_owner_key.txt for manual restore.

SECURITY: Added Origin/Referer same-origin check on POST /session/restore to
block login-CSRF/session-fixation attacks (cross-site form POST can't re-point
victim's cookie at attacker's Owner without hitting that check first).

Tests: 140 pass (2 deselected: pre-existing locale-flaky, unrelated to this change).
Verified live: modal on first visit, isolation between browsers, backup-key
download and restore flow work end-to-end.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

imptune/db/models.py

@@ -24,14 +24,27 @@ class BaseModel(Model):
         database = db
 
 
-class Client(BaseModel):
-    """Represents a deployment target (AD client / OU)."""
+class Owner(BaseModel):
+    """Cookie-scoped identity — no accounts, just an opaque bearer key."""
 
-    name = CharField(unique=True)
+    key = CharField(unique=True, index=True)
+    is_permanent = BooleanField(default=False)
+    created_at = DateTimeField(default=_utcnow)
+
+    class Meta:
+        table_name = "owner"
+
+
+class Client(BaseModel):
+    """Represents a deployment target (AD client / OU), scoped to an Owner."""
+
+    name = CharField()
+    owner = ForeignKeyField(Owner, backref="clients")
     created_at = DateTimeField(default=_utcnow)
 
     class Meta:
         table_name = "client"
+        indexes = ((("owner", "name"), True),)
 
 
 class Driver(BaseModel):
@@ -56,6 +69,7 @@ class Printer(BaseModel):
     name = CharField()
     ip_address = CharField()
     port_name = CharField()
+    owner = ForeignKeyField(Owner, backref="printers")
     client = ForeignKeyField(Client, null=True, backref="printers")
     driver = ForeignKeyField(Driver, null=True, backref="printers")
     duplex_mode = CharField(default="OneSided")