feat(#512): suspend authenticated execution without losing the document session

[BorisTyshkevich]

Summary

Phase 2 of #512 implements the approved document-session / authenticated-execution-scope boundary.

• keep the mounted shell, exact editor/tab/result objects, drafts, dirty state, route, and unload guard alive during involuntary auth loss
• close one disposable, epoch-fenced execution scope so Workbench, Dashboard, exports, graphs, catalog/docs, formatting, SHOW CREATE, and detached refreshes abort or become observationally stale
• cancel live server queries best-effort with an immutable lease containing the exact origin and complete pre-clear Authorization header, with no refresh/retry/auth callback path
• project auth loss through the red Sign in required header state and reuse the existing login controls inline
• resume Basic authentication in place with a fresh scope and connection-scoped metadata reload; explicit Log out remains destructive
• document the lifecycle boundary and carry PR fix(#502): run mandatory authenticated-session teardown on involuntary auth loss too #521's required teardown/race evidence into the general solution

This is intentionally Phase 2/3. OAuth redirect checkpoint and restored authored-tab state land from a fresh main branch in Phase 3.

Fixes #502.
Fixes #520.
Revalidates the already-closed #522 under the shared scope boundary.
Supersedes #521 after this PR merges.

Architectural invariants

• a registration is current only while retained by its original open credential epoch
• local abort happens synchronously before remote cleanup
• remote cleanup uses only a frozen cancellation lease; it cannot read mutated auth mode or credentials
• a stale completion cannot record History/results/parameters/schema/tokens/UI settlement into a replacement scope
• involuntary auth loss never calls the destructive login renderer or rebuilds the document shell
• post-confirmation query-level 401/403 remains a query error

Verification

• npm test — 190 files, 6,317 tests; 100% statements/lines tree-wide; all per-file gates pass
• npm run build — single dist/sql.html artifact built successfully
• git diff --check

[BorisTyshkevich]

Final review-fix pass is pushed in f175a1e:

• fence both initial and refreshed credential reads against epoch replacement, including an immediate pre-fetch guard
• retain the exact Basic scheme/host/port for in-shell recovery
• suppress unsafe inline OAuth navigation until Phase 3 provides the redirect checkpoint
• make the desktop auth-required state visibly red and text-labelled
• release Workbench execution registrations when config/token preflight rejects
• propagate scope cancellation signals through graph card/detail requests

Local gate: 190 files / 6,304 tests; 100% statements and lines; production build and git diff --check pass. Fresh independent final reviews and the updated CI run are in progress.

[BorisTyshkevich]

Review-fix summary: the third-party repeated Basic form-lock claim was confirmed and fixed; the current inline OAuth concern was already mitigated by suppression until Phase 3; overlapping recovery generation is also fenced; and auth/config async-authority plus catalog-cancellation findings are fixed. Final local gate: 6,317 tests, 100% statements and lines, and build passed.