rework session layer on PasswordSession + three-client pattern

- PasswordSession (@atproto/lex-password-session) is now the single auth
  core; SessionAgent bridges it to the base Agent from @atproto/api so
  the ~148 useAgent() consumer files keep working unchanged
- SessionBundle carries {session, agent, accountClient, appviewClient};
  useLexClient() now returns the authed appview client, new
  useAppviewClient()/usePdsClient() hooks
- reducer: OpaqueSessionBundle, new replaced-current-bundle action for
  network-free cross-tab same-did sync (PasswordSession is immutable, so
  the bundle is rebuilt instead of mutated in place)
- moderation: AtpAgent.configure -> Client.configure + Agent.configure,
  per-account labelers on both the bridge and the appview client
- push-token unregistration uses temporary PasswordSessions
- hard-tail migrations: SignupQueued refresh via resumeSession shim,
  useBeginAgeAssurance scoped-token raw Client, useAccountEmailState
  reads currentAccount
- PDS routing preserved on the no-network resume fast path by
  synthesizing a minimal didDoc from the persisted pdsUrl

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/state/queries/threadgate/index.ts

@@ -1,9 +1,4 @@
-import {
-  type AppBskyFeedDefs,
-  AppBskyFeedThreadgate,
-  type AtpAgent,
-  AtUri,
-} from '@atproto/api'
+import {type AppBskyFeedDefs, AppBskyFeedThreadgate, AtUri} from '@atproto/api'
 import {useMutation, useQuery, useQueryClient} from '@tanstack/react-query'
 
 import {networkRetry, retry} from '#/lib/async/retry'
@@ -17,7 +12,7 @@ import {
   threadgateViewToAllowUISetting,
 } from '#/state/queries/threadgate/util'
 import {useUpdatePostThreadThreadgateQueryCache} from '#/state/queries/usePostThread'
-import {useAgent} from '#/state/session'
+import {type SessionAgent, useAgent} from '#/state/session'
 import {useThreadgateHiddenReplyUrisAPI} from '#/state/threadgate-hidden-replies'
 import * as bsky from '#/types/bsky'
 
@@ -88,7 +83,7 @@ export async function getThreadgateRecord({
   agent,
   postUri,
 }: {
-  agent: AtpAgent
+  agent: SessionAgent
   postUri: string
 }): Promise<AppBskyFeedThreadgate.Record | null> {
   const urip = new AtUri(postUri)
@@ -150,7 +145,7 @@ export async function writeThreadgateRecord({
   postUri,
   threadgate,
 }: {
-  agent: AtpAgent
+  agent: SessionAgent
   postUri: string
   threadgate: AppBskyFeedThreadgate.Record
 }) {
@@ -176,7 +171,7 @@ export async function upsertThreadgate(
     agent,
     postUri,
   }: {
-    agent: AtpAgent
+    agent: SessionAgent
     postUri: string
   },
   callback: (
@@ -205,7 +200,7 @@ export async function updateThreadgateAllow({
   postUri,
   allow,
 }: {
-  agent: AtpAgent
+  agent: SessionAgent
   postUri: string
   allow: ThreadgateAllowUISetting[]
 }) {