collab-presence 0009 A: real session identity for presence + comments

presenceUser()/userSlug() now resolve the authenticated user: a plain
/api/me fetch (GPL no-link rule — no closed contract import) races the WASM
boot and is awaited before presence/comments bind. `?user=`/`?libowner=`
overrides are gated behind VITE_ALLOW_USER_OVERRIDE=1 (dev script + e2e
harnesses set it; prod builds never do). Anonymous/example-backend sessions
keep the pre-auth slug fallback. Fixes prod's empty presence (everyone was
"local-user", deduped as own tabs) and comment authorship in one move.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A42xfPFNdfsUt9eowkC9eM

tests/playwright-web.config.ts

@@ -91,6 +91,9 @@ export default defineConfig({
       // (scripts/dev-gpl.mjs). Only effective on cold starts: with
       // reuseExistingServer an already-running stack must have set it itself.
       VITE_LOCAL_PROJECTS: 'idb',
+      // e2e identity isolation: presence/comments specs mint per-run users via
+      // `?user=` — only builds that set this honor the param (0009).
+      VITE_ALLOW_USER_OVERRIDE: '1',
     },
   },
 });