rebuild the session lifecycle on passwordsession

Replace the AtpAgent-owned session lifecycle with PasswordSession-backed
bundles, dispatched through the bridge agent. The provider, reducer and
factories now hold a `{session, agent, service}` bundle whose identity gates
session events, so a stale session can no longer log out the current account
or restore its tokens after a switch.

Behavioural changes that come with the new auth core:
- token rotation is read from the hook payload (PasswordSession fires before
  committing its live getter), so refreshes persist the new tokens
- replaced bundles are disposed rather than mutated, since PasswordSession has
  no in-place patch; cross-tab syncs rebuild instead
- the expiry rescue path prefers a newer persisted generation over logging
  every tab out

Post-signup writes keep main's agent.* call style; createAccount synthesizes
the email/active fields the thinner lex output omits.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/view/com/composer/drafts/state/api.ts

@@ -11,7 +11,7 @@ import {mimeToExt} from '#/lib/media/video/util'
 import {shortenLinks} from '#/lib/strings/rich-text-manip'
 import {type ComposerImage} from '#/state/gallery'
 import {threadgateAllowUISettingToAllowRecordValue} from '#/state/queries/threadgate/util'
-import {createPublicAgent} from '#/state/session/agent'
+import {createPublicAgent} from '#/state/session/bridge-agent'
 import {
   type ComposerState,
   type EmbedDraft,