rebuild the session lifecycle on passwordsession

Replace the AtpAgent-owned session lifecycle with PasswordSession-backed
bundles, dispatched through the bridge agent. The provider, reducer and
factories now hold a `{session, agent, service}` bundle whose identity gates
session events, so a stale session can no longer log out the current account
or restore its tokens after a switch.

Behavioural changes that come with the new auth core:
- token rotation is read from the hook payload (PasswordSession fires before
  committing its live getter), so refreshes persist the new tokens
- replaced bundles are disposed rather than mutated, since PasswordSession has
  no in-place patch; cross-tab syncs rebuild instead
- the expiry rescue path prefers a newer persisted generation over logging
  every tab out

Post-signup writes keep main's agent.* call style; createAccount synthesizes
the email/active fields the thinner lex output omits.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

oxlint-suppressions.json

@@ -1456,11 +1456,6 @@
       "count": 1
     }
   },
-  "src/state/session/agent.ts": {
-    "typescript/no-explicit-any": {
-      "count": 1
-    }
-  },
   "src/state/shell/color-mode.tsx": {
     "typescript/no-floating-promises": {
       "count": 2