feat: add unified auth handoff flow

[Zetazzz]

Summary

• Add one-time Site handoff creation and redemption.
• Require trusted siteId, apiId, and principalId when redeeming a handoff.
• Add Site-session binding validation and unified-session revocation propagation.

Stack

Base: #1707
Next: #1709

Validation

• GraphQL server: 21 suites, 180 tests passed
• express-context: 5 suites, 37 tests passed
• affected package builds passed