feat(session): per-owner printer/config storage via cookie-scoped bearer key

Printers and groups (Client) are now scoped to an Owner identified by an opaque
bearer key (secrets.token_urlsafe(32)) stored in an httponly cookie, defaulting
to temporary. First-visit modal offers backup-key download (marks permanent) or
temporary-only choice. /session/restore re-attaches a fresh browser to a saved
key. Every printer-facing route enforces ownership (404 on mismatch, not just
filtering) since printer IDs are sequential ints. Drivers stay global/shared.

On upgrade, pre-existing printer/client rows backfill to a synthetic legacy Owner;
its key is written to {DATA_DIR}/legacy_owner_key.txt for manual restore.

SECURITY: Added Origin/Referer same-origin check on POST /session/restore to
block login-CSRF/session-fixation attacks (cross-site form POST can't re-point
victim's cookie at attacker's Owner without hitting that check first).

Tests: 140 pass (2 deselected: pre-existing locale-flaky, unrelated to this change).
Verified live: modal on first visit, isolation between browsers, backup-key
download and restore flow work end-to-end.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

tests/conftest.py

@@ -12,6 +12,21 @@ def client(tmp_data_dir):
         yield c
 
 
+@pytest.fixture
+def owner(client):
+    """The Owner the `client` fixture's cookie jar is scoped to.
+
+    Triggers the session middleware (any non-/health request creates the
+    cookie), then resolves the Owner record so tests can create Printer/Client
+    rows directly via the ORM that the same `client` can then see over HTTP.
+    """
+    from imptune.db.models import Owner
+    from imptune.services.session import COOKIE_NAME
+
+    client.get("/")
+    return Owner.get(Owner.key == client.cookies[COOKIE_NAME])
+
+
 @pytest.fixture
 def tmp_data_dir(tmp_path, monkeypatch):
     """Set DATA_DIR to a temp directory so tests don't write to /data."""