fix: share authentication and payment state across replicas

[ty-everett]

Summary

Authenticated requests could fail when the handshake and next request reached different production replicas, and the Express header-map wrapper prevented payment challenges from being emitted. Use published auth middleware 2.2.7, the published toolbox KnexSessionManager, and one durable atomic payment claim table shared by both page purchases and admin funding.

The additive migration preserves existing content, wallet, purchase and payout rows. Session/nonces use case-sensitive MySQL keys. Accepted payment claims do not expire and the migration refuses destructive rollback. The guarded promotion now requires a signed, correctly priced 402 challenge with spending disabled, explicitly alternating handshake/request traffic between both candidate replicas before public cutover.

Validation

• npm run lint
• npm run typecheck
• npm test — 39 tests across 14 files
• npm run build
• npm audit --omit=dev --audit-level=high — zero findings
• python3 -m unittest discover -s scripts/k8s/tests -v — seven rollout safety tests
• The five protocol-state tests also pass against isolated MySQL 8.4.11, including independent replicas, replay rejection, case-sensitive nonce keys, failure propagation and the actual promotion smoke.
• Verified encrypted backup restored successfully; the additive migration preserved every original table's row count/checksum and passed a second execution.
• Self-review covers the complete diff and the published package/provenance. Exact-head CI 36009524835 and runtime image policy 36009524831 passed at 6c89abd1fb73cea583e78739baadb5c7c6b87496; no open review threads. This repository has no CodeQL analysis for this PR; the API returns no analysis, not a zero-alert result.

Notes

No BRC-100 application protocol or wallet API migration is introduced. Production promotion remains a separate guarded workflow after exact-head CI/image checks and fresh fleet/control-plane gates. Retain all three additive protocol tables on rollback; do not restore an older payment-claim checkpoint after accepting payments. Real paid acceptance remains a separately bounded operator-authorized test and has not yet succeeded.

[ty-everett]

Maintainer self-review of exact head 6c89abd1fb73cea583e78739baadb5c7c6b87496 complete. I reviewed the shared session schema against the published KnexSessionManager, atomic replay claim behavior, case-sensitive nonce storage, fail-closed database failures, retained rollback state, both payment routes, cleanup lifecycle, real cross-replica promotion probes, lockfile/provenance, migration rehearsal and operator guidance. No unresolved issue was found. This is the authoring maintainer’s review, not an independent reviewer’s approval.

All 39 application tests, five real MySQL protocol tests, seven rollout safety tests, local lint/typecheck/build and production audit pass. Both exact-head hosted CI and runtime image policy pass; there are no review threads. CodeQL has no configured analysis here, so no CodeQL clean claim is made. Ready for the separately guarded production correction and bounded paid acceptance.