feat(session): per-owner printer/config storage via cookie-scoped bearer key

Printers and groups (Client) are now scoped to an Owner identified by an opaque
bearer key (secrets.token_urlsafe(32)) stored in an httponly cookie, defaulting
to temporary. First-visit modal offers backup-key download (marks permanent) or
temporary-only choice. /session/restore re-attaches a fresh browser to a saved
key. Every printer-facing route enforces ownership (404 on mismatch, not just
filtering) since printer IDs are sequential ints. Drivers stay global/shared.

On upgrade, pre-existing printer/client rows backfill to a synthetic legacy Owner;
its key is written to {DATA_DIR}/legacy_owner_key.txt for manual restore.

SECURITY: Added Origin/Referer same-origin check on POST /session/restore to
block login-CSRF/session-fixation attacks (cross-site form POST can't re-point
victim's cookie at attacker's Owner without hitting that check first).

Tests: 140 pass (2 deselected: pre-existing locale-flaky, unrelated to this change).
Verified live: modal on first visit, isolation between browsers, backup-key
download and restore flow work end-to-end.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

imptune/main.py

@@ -5,9 +5,10 @@ from pathlib import Path
 from fastapi import FastAPI
 from fastapi.staticfiles import StaticFiles
 
-from imptune.api import clients, drivers, health, icons, pages, packages, printers, scripts
+from imptune.api import clients, drivers, health, icons, pages, packages, printers, scripts, session
 from imptune.config import DATA_DIR, DRIVERS_DIR, ICONS_DIR
 from imptune.db.database import db, init_db
+from imptune.services.session import OwnerSessionMiddleware
 
 
 @asynccontextmanager
@@ -23,6 +24,7 @@ async def lifespan(app: FastAPI):
 
 
 app = FastAPI(title="ImpTune", lifespan=lifespan)
+app.add_middleware(OwnerSessionMiddleware)
 
 # Serve baked-in static assets (pico.min.css, htmx.min.js, alpine.min.js)
 _static_dir = Path(__file__).parent / "static"
@@ -37,3 +39,4 @@ app.include_router(clients.router)
 app.include_router(scripts.router)
 app.include_router(packages.router)
 app.include_router(icons.router)
+app.include_router(session.router)