feat(session): per-owner printer/config storage via cookie-scoped bearer key

Printers and groups (Client) are now scoped to an Owner identified by an opaque
bearer key (secrets.token_urlsafe(32)) stored in an httponly cookie, defaulting
to temporary. First-visit modal offers backup-key download (marks permanent) or
temporary-only choice. /session/restore re-attaches a fresh browser to a saved
key. Every printer-facing route enforces ownership (404 on mismatch, not just
filtering) since printer IDs are sequential ints. Drivers stay global/shared.

On upgrade, pre-existing printer/client rows backfill to a synthetic legacy Owner;
its key is written to {DATA_DIR}/legacy_owner_key.txt for manual restore.

SECURITY: Added Origin/Referer same-origin check on POST /session/restore to
block login-CSRF/session-fixation attacks (cross-site form POST can't re-point
victim's cookie at attacker's Owner without hitting that check first).

Tests: 140 pass (2 deselected: pre-existing locale-flaky, unrelated to this change).
Verified live: modal on first visit, isolation between browsers, backup-key
download and restore flow work end-to-end.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

tests/test_script_generator.py

@@ -3,7 +3,7 @@ import pytest
 from imptune.generators.script_generator import render_detect, render_install, render_uninstall
 
 
-def _create_test_driver_and_printer():
+def _create_test_driver_and_printer(owner):
     """Helper: create a Driver + Printer for integration tests."""
     from imptune.db.models import Driver, Printer
 
@@ -19,6 +19,7 @@ def _create_test_driver_and_printer():
         ip_address="10.0.0.1",
         port_name="IP_10.0.0.1",
         driver=driver,
+        owner=owner,
         duplex_mode="LongEdge",
         color_mode=True,
         paper_size="A4",
@@ -149,25 +150,25 @@ def test_render_detect():
 # ---------------------------------------------------------------------------
 
 
-def test_install_endpoint(client):
+def test_install_endpoint(client, owner):
     """GET /printers/{id}/scripts/install returns 200 with pnputil in content."""
-    _driver, printer = _create_test_driver_and_printer()
+    _driver, printer = _create_test_driver_and_printer(owner)
     response = client.get(f"/printers/{printer.id}/scripts/install")
     assert response.status_code == 200
     assert "pnputil" in response.text
 
 
-def test_uninstall_endpoint(client):
+def test_uninstall_endpoint(client, owner):
     """GET /printers/{id}/scripts/uninstall returns 200 with Remove-Printer in content."""
-    _driver, printer = _create_test_driver_and_printer()
+    _driver, printer = _create_test_driver_and_printer(owner)
     response = client.get(f"/printers/{printer.id}/scripts/uninstall")
     assert response.status_code == 200
     assert "Remove-Printer" in response.text
 
 
-def test_detect_endpoint(client):
+def test_detect_endpoint(client, owner):
     """GET /printers/{id}/scripts/detect returns 200 with Write-Output in content."""
-    _driver, printer = _create_test_driver_and_printer()
+    _driver, printer = _create_test_driver_and_printer(owner)
     response = client.get(f"/printers/{printer.id}/scripts/detect")
     assert response.status_code == 200
     assert "Write-Output" in response.text
@@ -179,7 +180,7 @@ def test_script_endpoint_missing_printer(client):
     assert response.status_code == 404
 
 
-def test_script_endpoint_no_driver(client):
+def test_script_endpoint_no_driver(client, owner):
     """GET /printers/{id}/scripts/install returns 422 when no driver assigned."""
     from imptune.db.models import Printer
 
@@ -188,6 +189,7 @@ def test_script_endpoint_no_driver(client):
         ip_address="10.0.0.2",
         port_name="IP_10.0.0.2",
         driver=None,
+        owner=owner,
         duplex_mode="OneSided",
         color_mode=True,
         paper_size="A4",