Enforce one admission notification per request - #192

What changed

• makes the current pending access-request generation the only user-visible admission notification
• retires post-admission and legacy admitted-epoch delivery without deleting compatible Durable Object state
• removes the standalone notify-admitted operator command
• uses one realm-neutral Hegemony welcome message
• locks each request to one FID-bound transport target and treats terminal timestamps as monotonic receipts

Why

One admission cycle could produce both a pending-request alert and a later admitted-epoch reconciliation alert. The two generations had different IDs, so generation-local idempotency correctly accepted both. Token refreshes and multi-client subscriptions also needed stronger cross-lifecycle bounds.

Player impact

An opted-in player can now receive at most one logical Farcaster notification for a given access request. It contains no realm name, FID, username, other-player event, token, or private state. A genuinely new request timestamp after a reviewed reset is the only reset boundary.

Validation

• repository typecheck
• 2,999 repository tests
• 317 auth-bridge tests
• 12 Cloudflare workerd tests
• 61 Hermes security tests
• Wrangler production bundle dry-run with the live activation values preserved
• independent review of retries, token rotation, stale generations, cross-FID isolation, and persisted legacy queues

No production notification or database mutation was used for validation.