[VibeSWE]

Browser login with the same credentials as an in-flight Basic-auth query could remove that query's cached session between middleware authorization and the handler's permission lookup. The query then returned User does not have access to stream despite valid credentials.

Keep the credential-keyed Basic session when issuing the browser cookie. Password changes and deletion still invalidate both tracked sessions; role changes still refresh both. Cookie logout and expiration remain session-specific.

Validation:

• All 22 rbac::lock_order_tests pass using the full native Rust test target.
• The new deterministic interleaving test fails against the original oidc.rs on c5e1e08f because the Basic session disappears, and passes with this fix.
• Revocation, cookie expiration and existing lock-order race tests are included; rustfmt and git diff --check pass.
• Independent Sol 6.1 review found no actionable security or correctness regression.

This fixes the transient authorization failure discovered during PR #55 validation. Staging conversion visibility and Parquet-file lifetime are separate fixes; no Prism/UI changes are included.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}