fix(gateway)!: replace token cookies with revocable sessions and harden abuse controls

- Replace user:token cookies with opaque server-side sessions, revocable on logout, delete, recreate and expiry; bind every credential to the path user and add cross-user regression tests.
- Rate-limit /users and /login, add optional signup invite codes and form same-origin checks, and unify login failures to 401.
- Require explicit ALLOW_INSECURE_COOKIES for plain HTTP, use __Host-dsh_gw_session when secure, and fix secure cookie deletion.
- Strip client-supplied forwarding/SSO headers, add an optional upstream allowlist, per-user in-flight and WebSocket message caps, credential-free handshake errors, and sweep-time state pruning.
- Digest-pin base images, hash-pin gateway dependencies, verify DSH_COMMIT in the build, and run the gateway image as non-root with a pinned Python base.
- Update manifests, production checklist, architecture/security docs and add an SSO preflight script.

BREAKING CHANGE: existing dsh_gw_session=<user>:<token> cookies are invalid; users must sign in again. Unknown users on POST /login now return 401 instead of 404, and the gateway refuses COOKIE_SECURE=false unless ALLOW_INSECURE_COOKIES=1.

AGENTS.md

@@ -117,17 +117,33 @@ needs kind plus the agent-sandbox CRDs (see the example README).
 
 - AUTH_PROXY_HEADER is opt-in. Only enable it when the gateway Service is
   reachable exclusively through the authenticating proxy; otherwise any client
-  can spoof X-Forwarded-User.
+  can spoof X-Forwarded-User. The SSO variant's NetworkPolicy is required for
+  production, and `examples/dsh-agents-as-a-service/scripts/preflight-sso.sh`
+  verifies the setup (Secrets, gateway env, TLS reference, placeholders, second
+  paths).
 - The example gateway reads the DSH launch token from pod logs. Treat pod logs
   as sensitive and keep its RBAC namespace-scoped.
+- Browser sessions are opaque server-side ids held in gateway memory: they are
+  revocable (logout/delete/recreate/expiry) but a gateway restart logs everyone
+  out and horizontal scaling needs a shared store. Session cookies are never
+  accepted as bearer tokens.
+- AUTH_RATE_LIMIT, SIGNUP_INVITE_CODE, MAX_IN_FLIGHT_PER_USER and
+  WS_MAX_MESSAGE_BYTES are in-process abuse guards, not ingress rate limits,
+  quotas or an audit log. Add those for an internet-facing deployment.
 - The example shares provider keys (dsh-provider-keys plus the optional
   dsh-provider-keys-extra) across sandboxes; do not describe it as
   tenant-isolated.
-- gVisor, nodeSelector, the NetworkPolicies, extra provider keys and failed-Pod
-  recovery are opt-in and are not active in the base manifests; do not describe
-  the base example as hardened.
-- TLS terminates outside the gateway; set COOKIE_SECURE=true for HTTPS and keep
-  the base manifest safe for local HTTP.
+- gVisor, nodeSelector, the shipped sandbox/exposure NetworkPolicies and the
+  documented gateway egress policy, extra provider keys and failed-Pod recovery
+  are opt-in and are not active in the base manifests; do not describe the base
+  example as hardened.
+  The sandbox and gateway-egress policies are required production steps; an
+  exposure without its NetworkPolicy is demo-only. See the example's
+  production checklist.
+- TLS terminates outside the gateway. Set COOKIE_SECURE=true for HTTPS and drop
+  ALLOW_INSECURE_COOKIES; the gateway refuses COOKIE_SECURE=false unless
+  ALLOW_INSECURE_COOKIES=1, which is only for the plain-HTTP local demo. Never
+  expose that combination.
 
 ## Ask before