Replace the AtpAgent-owned session lifecycle with PasswordSession-backed
bundles, dispatched through the bridge agent. The provider, reducer and
factories now hold a `{session, agent, service}` bundle whose identity gates
session events, so a stale session can no longer log out the current account
or restore its tokens after a switch.
Behavioural changes that come with the new auth core:
- token rotation is read from the hook payload (PasswordSession fires before
committing its live getter), so refreshes persist the new tokens
- replaced bundles are disposed rather than mutated, since PasswordSession has
no in-place patch; cross-tab syncs rebuild instead
- the expiry rescue path prefers a newer persisted generation over logging
every tab out
Post-signup writes keep main's agent.* call style; createAccount synthesizes
the email/active fields the thinner lex output omits.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Samuel Newman