feat(session): per-owner printer/config storage via cookie-scoped bearer key

Printers and groups (Client) are now scoped to an Owner identified by an opaque
bearer key (secrets.token_urlsafe(32)) stored in an httponly cookie, defaulting
to temporary. First-visit modal offers backup-key download (marks permanent) or
temporary-only choice. /session/restore re-attaches a fresh browser to a saved
key. Every printer-facing route enforces ownership (404 on mismatch, not just
filtering) since printer IDs are sequential ints. Drivers stay global/shared.

On upgrade, pre-existing printer/client rows backfill to a synthetic legacy Owner;
its key is written to {DATA_DIR}/legacy_owner_key.txt for manual restore.

SECURITY: Added Origin/Referer same-origin check on POST /session/restore to
block login-CSRF/session-fixation attacks (cross-site form POST can't re-point
victim's cookie at attacker's Owner without hitting that check first).

Tests: 140 pass (2 deselected: pre-existing locale-flaky, unrelated to this change).
Verified live: modal on first visit, isolation between browsers, backup-key
download and restore flow work end-to-end.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

imptune/templates/base.html

@@ -315,6 +315,10 @@
         <li><a href="/packages" {% if request.url.path == "/packages" %}class="active"{% endif %}
                x-data x-text="$store.i18n.t('packages')">Packages</a></li>
       </ul>
+      <ul class="sidebar-nav sidebar-nav-footer">
+        <li><a href="/session/key/download">Download backup key</a></li>
+        <li><a href="/session/restore" {% if request.url.path == "/session/restore" %}class="active"{% endif %}>Restore from backup key</a></li>
+      </ul>
     </nav>
     <div class="main-wrapper">
       <header class="topbar">
@@ -333,6 +337,20 @@
         </div>
       </header>
       <main class="main-content">
+        {% if request.state.is_new_owner %}
+        <dialog open id="session-choice-modal">
+          <article>
+            <h3>Keep your printers?</h3>
+            <p>Your printers, configs, and groups are private to this browser
+            (drivers stay shared with everyone). If you clear your cookies
+            without a backup key, they're gone for good.</p>
+            <footer>
+              <a role="button" href="/session/key/download">Store permanently (download backup key)</a>
+              <button class="secondary" onclick="this.closest('dialog').close()">Keep temporary, this browser only</button>
+            </footer>
+          </article>
+        </dialog>
+        {% endif %}
         {% block content %}{% endblock %}
       </main>
     </div>