[P2][Plan 4] SF-034 — Correct or remove the broken legacy SessionBridge migration

[Ankit6149]

Confirmed problem

SessionBridge waits for /api/session to return data.token before marking migration complete, but the session route returns authentication state and expiry without a token. The compatibility bridge cannot complete as documented.

Scope

• Decide whether legacy token migration is still required.
• If required, redesign it around the actual secure session contract without exposing tokens to page JavaScript.
• If no longer required, remove the bridge, legacy storage key handling, dead UI, and documentation.
• Make migration idempotent and visibly recoverable on failure.

Acceptance criteria

• No code waits for a session response field that does not exist.
• Secure session behavior remains HTTP-only and does not leak credentials.
• Legacy state is either migrated exactly once or deliberately retired.
• The app no longer repeats failed migration work on every load.
• Authentication and owner-lock flows continue to pass.

Required verification

• Legacy-session fixture test if retained.
• Fresh session, expired session, non-owner, and owner tests.
• Repository search confirming removed keys/bridge references if retired.