fix: reconcile CodeRabbit promotion findings

[BeforeLights]

Summary\n\nReconciles the single CodeRabbit review on promotion PR #35 before the next promotion packet.\n\n- fixes all valid inline findings and the two outside-diff OpenAPI claims\n- records accepted and rejected review-body suggestions in docs/operations/coderabbit-pr-35-disposition.md\n- adds focused IAM, AUD, BUA, i18n, migration, API-contract, and performance regressions\n- preserves the no-legacy-session-backfill safety decision\n\n## Verification\n\n- corepack pnpm repo:check\n- corepack pnpm repo:build\n- 41 independently reversible commits\n\nThis is a fix PR into dev; CodeRabbit is intentionally not invoked on dev-bound PRs. After merge, the changes will be included in a new main promotion slice with one CodeRabbit review.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 397a2f3d-1bfd-4a7b-a1bc-d4e641ea8ed6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}