feat(marketing): make account header session-aware

[ORESoftware]

Summary

Stacks on #7 and replaces the always-visible login/dashboard trio with a token-blind account-state header:

• neutral pre-check label: Account;
• anonymous state: Log in plus Sign up;
• authenticated state: User dashboard, with signup hidden;
• exact cross-origin session probe to https://app.zpkg.net;
• 50-minute foreground refresh timer;
• focus, visibility, and online recovery;
• best-effort service-worker Periodic Background Sync;
• strict CSP connect-src and worker-src boundaries.

Security boundary

The static site never reads or stores a JWT, access token, refresh handle, email, principal, or Supabase/Shared Auth secret. Requests use only the app's host-only HttpOnly session cookie through credentials: include; failures leave the neutral Account state rather than failing open.

Tests

The browser contract covers anonymous and authenticated desktop/mobile header states, exact destinations, hidden signup for authenticated users, no anonymous refresh, authenticated foreground refresh, responsive layout, and static checks against local/session storage or bearer-field names.

Dependencies and evidence

• Base PR: feat(marketing): add app login, signup, and dashboard navigation #7, providing the stable static account destinations.
• Rust BFF: zed-pkg/zed-web-server.rs#20.
• Green exact-head certification: zed-pkg-test/registry-browser-e2e#9.
• Production activation remains gated on Shared Auth PKCE/handoff certification and registered-client provisioning.
• Linear: DEN-2859.

[ORESoftware]

Semantically integrated into main at 77fccef with the hardened GET-only session-continuity contract from zed-web-server.rs#23. The merged result preserves the session-aware header while removing the superseded cross-origin refresh mutation and background worker, adds one-in-flight/jitter/timeout/fail-safe behavior, and passes the locked Astro build plus real Chromium contract. GitHub cannot retarget this stacked PR to main because its head is already an ancestor of main.