fix(console): check the owner-to-PM edge on every intake control, refuse request URLs without SSO, bound the browser waits (#1839)

Review r1 of lifecycle Task 3.

C1: the four owner controls (answer, attach, mode, cancel) inserted and routed a
human-to-PM message without the messaging policy check message.send makes. The
shared writer now reads the current human-to-PM edge inside the control's
transaction, before it inserts or routes anything, and refuses with
message-sender-refused. The refusal rolls back the journal row, the human.input
event, the message and a withdrawn selection decision. The cancel withdrawal
checks the same edge. Regression tests close the edge after the question and
cover all four controls, then reopen it and prove the same call lands once.

I1: serve.mjs read sso.publicOrigin for a request URL when the Console ran
without --sso (or in preview mode), which ended the process on an unauthenticated
GET /api/requests/r1. A request route now answers through requestHTTP with no
transports and no SSO fields: unavailable on a read, read-only on a write, 405
for the wrong method. Listener tests cover GET and POST without SSO and in
preview mode, named and loopback, and the process keeps serving.

M1: the browser test waiter allowed about 3 s and reload() could run out its loop
without failing. Waits are now deadline-bound at 15 s and name the expression,
and reload() waits for the new document's own ready flag and the mounted chat,
and throws if it never gets there. The no-repost and stored-answer assertions of
the lost-answer case are unchanged.

Migration 3p-3q is unchanged.

packages/webui/src/serve.mjs

@@ -783,8 +783,11 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
     // granted user stopped at userRoute above. Reads need the read transport; the writes also --send.
     if (requestPath) {
       if (tester) return requestRefuse(res, 'not-found');
-      const ready = named && sso !== null;
-      return requestHTTP(req, res, { path, requestRead: ready ? requestRead : null, requestWrite: ready && send ? requestWrite : null,
+      // Without SSO there is no owner session to act as, and preview mode has none either. Refuse here, before any
+      // SSO field is read: requestHTTP answers a missing transport itself and touches no session, live check or origin.
+      if (!(named && sso !== null))
+        return requestHTTP(req, res, { path, requestRead: null, requestWrite: null, session: null, live: () => null, origin: null, log });
+      return requestHTTP(req, res, { path, requestRead, requestWrite: send ? requestWrite : null,
         session: ssoSession, live: () => sso.session(req), origin: sso.publicOrigin, log });
     }
     // Row 194 (#1692, D4.1): the tester also launches and terminates.