feat: implement GEWU service and local agent workflows

docs/acceptance/2026-10-14-session-restoration.md

@@ -0,0 +1,30 @@
+# Restore sign-in after page reload — 14 October 2026
+
+The page now restores a valid human session on mount through `GET /v1/session`,
+using the existing HttpOnly cookie. It recovers an in-memory CSRF token and reloads
+permissions and data. Reloading or navigating between library, administration and
+agent credentials no longer requires passwords while the session remains valid.
+
+A stable one-way CSRF token is derived from the private session secret. An additive
+`restored_csrf_digest` column preserves the original token for other tabs and already
+issued sessions. Restoration neither exposes the cookie nor extends its eight-hour
+expiry. Same-origin checks and a custom client header protect restoration. Expired,
+revoked and signed-out sessions return 401; the UI then shows sign-in. No local or
+session storage is used. A failed restored admin-page permission check preserves the
+valid session rather than signing the user out of other surfaces.
+
+PASS: 183 backend tests; 22 frontend tests, TypeScript, ESLint and production build;
+Ruff check/format, mypy, module boundaries and generated operation/agent contracts.
+Regression cases include pre-upgrade migration, old-tab CSRF preservation, stable
+restoration, original expiry, revocation, origin/header checks, remount restoration
+in admin and library, and explicit sign-out returning to the login form.
+
+Live HTTPS smoke check: session restoration 200 twice, stable CSRF, unchanged
+expiry, authenticated admin project list 200, sign-out with the original tab's CSRF
+200, restoration after sign-out 401. The smoke check's temporary session was revoked;
+no operator account password or existing user session was changed.
+
+LIMITED: collaborative preview navigation timed out, so a complete rendered browser
+reload walkthrough was not observed. Remount behavior is covered by component tests
+and the deployed HTTPS session protocol was verified directly. No knowledge records
+were changed, unrelated work was preserved, and no commit was made.