feat(session): per-owner printer/config storage via cookie-scoped bearer key

Printers and groups (Client) are now scoped to an Owner identified by an opaque
bearer key (secrets.token_urlsafe(32)) stored in an httponly cookie, defaulting
to temporary. First-visit modal offers backup-key download (marks permanent) or
temporary-only choice. /session/restore re-attaches a fresh browser to a saved
key. Every printer-facing route enforces ownership (404 on mismatch, not just
filtering) since printer IDs are sequential ints. Drivers stay global/shared.

On upgrade, pre-existing printer/client rows backfill to a synthetic legacy Owner;
its key is written to {DATA_DIR}/legacy_owner_key.txt for manual restore.

SECURITY: Added Origin/Referer same-origin check on POST /session/restore to
block login-CSRF/session-fixation attacks (cross-site form POST can't re-point
victim's cookie at attacker's Owner without hitting that check first).

Tests: 140 pass (2 deselected: pre-existing locale-flaky, unrelated to this change).
Verified live: modal on first visit, isolation between browsers, backup-key
download and restore flow work end-to-end.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

tests/e2e/conftest.py

@@ -34,6 +34,10 @@ def live_server(tmp_path_factory):
     os.makedirs(cfg.DRIVERS_DIR, exist_ok=True)
     os.makedirs(cfg.ICONS_DIR, exist_ok=True)
 
+    # Plain HTTP loopback server — Secure-flagged cookies would be dropped
+    # inconsistently across browser engines, so disable that flag for E2E.
+    cfg.COOKIE_SECURE = False
+
     # Also set env var so lifespan handler picks up correct dirs
     os.environ["DATA_DIR"] = str(data_dir)
 
@@ -68,3 +72,31 @@ def live_server(tmp_path_factory):
 
     server.should_exit = True
     thread.join(timeout=2.0)
+
+
+@pytest.fixture(scope="session")
+def _e2e_owner_key(live_server):
+    """One Owner shared by every E2E browser context.
+
+    E2E specs cover unrelated UI (theme, i18n, port autofill); without a
+    pre-existing cookie each fresh Playwright context would be treated as a
+    first-time visitor and blocked by the onboarding modal (a real <dialog>
+    that intercepts all pointer events until dismissed).
+    """
+    from imptune.services.session import COOKIE_NAME
+
+    resp = httpx.get(f"{live_server}/")
+    return resp.cookies[COOKIE_NAME]
+
+
+@pytest.fixture(autouse=True)
+def _seed_owner_cookie(page, live_server, _e2e_owner_key):
+    """Pre-seed the owner cookie so the first-visit modal never appears in specs unrelated to onboarding."""
+    from urllib.parse import urlparse
+
+    from imptune.services.session import COOKIE_NAME
+
+    hostname = urlparse(live_server).hostname
+    page.context.add_cookies(
+        [{"name": COOKIE_NAME, "value": _e2e_owner_key, "domain": hostname, "path": "/"}]
+    )

tests/e2e/test_printer_edit.py

@@ -4,12 +4,16 @@ from __future__ import annotations
 import pytest
 
 
-def test_printer_edit_modal_open_and_prefill(page, live_server: str) -> None:
+def test_printer_edit_modal_open_and_prefill(page, live_server: str, _e2e_owner_key: str) -> None:
     """Edit button opens modal with printer's current name pre-filled."""
     import httpx
 
-    # Create a printer via API
-    with httpx.Client(base_url=live_server, follow_redirects=True) as api:
+    from imptune.services.session import COOKIE_NAME
+
+    # Create a printer via API, under the same owner the page's cookie is seeded with
+    with httpx.Client(
+        base_url=live_server, follow_redirects=True, cookies={COOKIE_NAME: _e2e_owner_key}
+    ) as api:
         api.post(
             "/printers",
             data={
@@ -30,11 +34,15 @@ def test_printer_edit_modal_open_and_prefill(page, live_server: str) -> None:
     assert name_val == "EditTest Printer"
 
 
-def test_printer_edit_submit_updates_list(page, live_server: str) -> None:
+def test_printer_edit_submit_updates_list(page, live_server: str, _e2e_owner_key: str) -> None:
     """Submitting the edit form updates the printer name in the list (no page reload)."""
     import httpx
 
-    with httpx.Client(base_url=live_server, follow_redirects=True) as api:
+    from imptune.services.session import COOKIE_NAME
+
+    with httpx.Client(
+        base_url=live_server, follow_redirects=True, cookies={COOKIE_NAME: _e2e_owner_key}
+    ) as api:
         resp = api.post(
             "/printers",
             data={