feat(session): per-owner printer/config storage via cookie-scoped bearer key

Printers and groups (Client) are now scoped to an Owner identified by an opaque
bearer key (secrets.token_urlsafe(32)) stored in an httponly cookie, defaulting
to temporary. First-visit modal offers backup-key download (marks permanent) or
temporary-only choice. /session/restore re-attaches a fresh browser to a saved
key. Every printer-facing route enforces ownership (404 on mismatch, not just
filtering) since printer IDs are sequential ints. Drivers stay global/shared.

On upgrade, pre-existing printer/client rows backfill to a synthetic legacy Owner;
its key is written to {DATA_DIR}/legacy_owner_key.txt for manual restore.

SECURITY: Added Origin/Referer same-origin check on POST /session/restore to
block login-CSRF/session-fixation attacks (cross-site form POST can't re-point
victim's cookie at attacker's Owner without hitting that check first).

Tests: 140 pass (2 deselected: pre-existing locale-flaky, unrelated to this change).
Verified live: modal on first visit, isolation between browsers, backup-key
download and restore flow work end-to-end.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

tests/test_upload_export_roundtrip.py

@@ -18,7 +18,7 @@ def driver_zip_bytes():
 
 
 def test_upload_then_ninja_export_finds_driver_on_disk(
-    client, tmp_data_dir, driver_zip_bytes
+    client, tmp_data_dir, driver_zip_bytes, owner
 ):
     from imptune.db.models import Client, Driver, Printer
 
@@ -33,13 +33,14 @@ def test_upload_then_ninja_export_finds_driver_on_disk(
     driver.driver_desc = json.dumps(["HP LaserJet Pro"])
     driver.save()
 
-    tenant = Client.create(name="Acme Corp")
+    tenant = Client.create(name="Acme Corp", owner=owner)
     printer = Printer.create(
         name="Round Trip Printer",
         ip_address="192.168.1.50",
         port_name="IP_192.168.1.50",
         client=tenant,
         driver=driver,
+        owner=owner,
     )
 
     resp = client.get(f"/printers/{printer.id}/packages/ninja")