mrhid6
a5f9fca59e
One middleware, two ways to arrive at the same *Session, so every handler, role guard, licence gate and audit call is untouched. The host guard applies to both: a token carries an instance, and the tenant boundary must not have a token-shaped hole in it. The effective role is min(user, token) recomputed per request, so demoting somebody demotes their tokens with them. A stale cookie beside a valid bearer falls through rather than refusing a credential that would work.