feat(backend): make browser sessions idempotent

[gcharang]

Summary

• accept an optional Idempotency-Key UUID on session creation
• derive a tenant-salted deterministic session nonce so retries converge without exposing the key
• preserve fresh random sessions when the header is absent and reject malformed, empty, or whitespace-only keys
• update backend and cross-repository integration documentation

Test plan

• pnpm --filter @understudy/backend typecheck
• pnpm --filter @understudy/backend exec vitest run test/auth.test.ts test/service.test.ts --reporter=dot — 98 tests passed