Bind dashboard tokens to session rotation

[owenshuo]

/claim #4170

Summary

• centralize dashboard auth checks in AuthMiddleware for both bearer-token and browser-cookie clients
• deny anonymous, revoked/stale, missing rotation metadata, rotation-mismatched, missing workspace, and insufficient-role principals
• allow authorized users with matching session/token rotation and an admin/owner workspace role to complete the same dashboard workflow
• add deterministic tests for stale, revoked, anonymous, insufficient scope, browser session, and authorized token clients

Verification

• python3 -m pytest tests/test_dashboard_session_auth.py -q
• python3 -m flake8 src/api/middleware.py src/agent/init.py tests/test_dashboard_session_auth.py
• git diff --check