[anurag629]

Slice T9 of P1 (F-04 task 11): host-site identity, uid on conversations, and tiers.

Server (identity: { secret, tiers? }, needs sessionSecrets):

• /session takes a userToken: an HS256 JWT signed by the host site with identity.secret, with sub (the user id, up to 128 characters), exp, and an optional tier. A token that doesn't verify, has expired or has no sub gets 401 session_required, not an anonymous session, so a bug on the host site shows up. A userToken with identity off gets 400.
• The user id and tier go into the session token. A chat request stamps metadata.uid on the conversation with its first message, only when it has none.
• Resume rules: a signed-in user can resume their own conversation with a fresh userToken, even without the old session token (a new device or cleared storage). Another user, or an anonymous visitor, gets a new conversation. A previous session token that belonged to another user doesn't carry over.
• identity.tiers maps a tier to budgets merged over budgets. Counts are shared, and the guards are built at startup, so a bad tier budget fails there.

Widget: userToken / data-user-token, sent with every /session request. ChatClient now takes the widget config directly, which keeps the size at 14.29 kB of 14.5 kB.

Docs: a "Signed-in visitors" section on the setup page, with a dependency-free Node signing sample. I checked that a token signed exactly as the sample does verifies with the server. The widget configuration page lists the option.

Checks: build, typecheck, pnpm test:coverage (1159 passed). New tests: 6 server tests for stamping, resume across users, bad tokens, identity off, tiers and startup checks, plus a widget test for sending the token. Lint is at the dev baseline, size passes, and the website builds.