rework session layer on PasswordSession + three-client pattern

- PasswordSession (@atproto/lex-password-session) is now the single auth
  core; SessionAgent bridges it to the base Agent from @atproto/api so
  the ~148 useAgent() consumer files keep working unchanged
- SessionBundle carries {session, agent, accountClient, appviewClient};
  useLexClient() now returns the authed appview client, new
  useAppviewClient()/usePdsClient() hooks
- reducer: OpaqueSessionBundle, new replaced-current-bundle action for
  network-free cross-tab same-did sync (PasswordSession is immutable, so
  the bundle is rebuilt instead of mutated in place)
- moderation: AtpAgent.configure -> Client.configure + Agent.configure,
  per-account labelers on both the bridge and the appview client
- push-token unregistration uses temporary PasswordSessions
- hard-tail migrations: SignupQueued refresh via resumeSession shim,
  useBeginAgeAssurance scoped-token raw Client, useAccountEmailState
  reads currentAccount
- PDS routing preserved on the no-network resume fast path by
  synthesizing a minimal didDoc from the persisted pdsUrl

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/state/session/additional-moderation-authorities.ts

@@ -1,4 +1,5 @@
-import {AtpAgent} from '@atproto/api'
+import {Agent} from '@atproto/api'
+import {Client} from '@atproto/lex-client'
 
 import {device} from '#/storage'
 
@@ -82,9 +83,16 @@ export function configureAdditionalModerationAuthorities() {
     additionalLabelers = []
   }
 
+  /*
+   * Merge with the currently-configured global labelers on the base `Agent`
+   * static (the bridge agent is a base `Agent`, not `AtpAgent`). Set the merged
+   * result on BOTH request paths - the lex `Client` static and the base `Agent`
+   * static - so both emit identical global `atproto-accept-labelers` headers.
+   */
   const appLabelers = Array.from(
-    new Set([...AtpAgent.appLabelers, ...additionalLabelers]),
+    new Set([...Agent.appLabelers, ...additionalLabelers]),
   )
 
-  AtpAgent.configure({appLabelers})
+  Client.configure({appLabelers: appLabelers as `did:${string}:${string}`[]})
+  Agent.configure({appLabelers})
 }