Authorize browser state through session-aware transports
Bind HTTP requests, Reflex socket events, custom WebSocket routes, and uploads to verified browser sessions before accessing state. Cookie-less sockets receive session/client tokens in-band so hydration can start immediately. Fresh clients in off mode also receive a routing token.
POST /_reflex/session installs an HttpOnly cookie only from a trusted Origin when exchanging an in-band credential; wildcard CORS alone cannot authorize that exchange. Existing valid cookies take precedence. Cookies use Secure, SameSite=None, and Partitioned with the documented development fallback. Enterprise's /_reflex/auth/token contract is unchanged.
Event contexts inherit browser authority, explicit None means anonymous, and trusted server work can use SessionToken.SYSTEM. Custom WebSockets no longer inherit SYSTEM accidentally. Authenticated live sockets can renew their own credential after cookie expiry while preserving owner and tab bindings. HTTP responses advertise the refresh interval. Streamed uploads use a distinct transaction context.
The internal transport module is named reflex.session_middleware to preserve the public rx.session() database helper across import orders. Dependency floors and deprecation versions match current main.
Depends on #7361; followed by #7363 and #7364. Rebased on main d02ba5409.
Validation: 390 transport/context/upload tests against an isolated real Redis server, two fresh-process database import regressions, full stack unit tests (12,147 passed; 80.15% coverage), and clean pyright reflex tests. Regressions reproduce the custom-WebSocket authority, off-mode token, and idle-renewal failures before their fixes. Real Uvicorn/Granian/browser coverage is in #7364.
Related to ENG-12911, ENG-12912, ENG-12913, ENG-12914, ENG-12915, ENG-9088.