[roncodes]

The service side of the publisher website and the staff review console (Phase 2, Workstream F). The website UI itself is not in this PR; it will be rebuilt in Inertia after a design pass.

What's in it

• Web sessions. A web guard backed by server-side flbs_ session tokens, with GET/POST/DELETE /v1/auth/session. Requests that carry the session or XSRF-TOKEN cookie (and /v1/auth/session itself) run through Laravel's session and CSRF middleware; Bearer clients, the catalog and the instance API stay cookieless. Account, publisher and admin routes now take a Bearer token or the session (auth:token,web). Adds the sessions table.
• Account. PATCH /v1/account, POST /v1/account/password; AccountResource adds is_staff.
• Organizations and members. List, create, show, update; add a member by email, change roles, remove or leave. Only owners grant or change the owner role, and the last owner can't be removed or demoted.
• Listing media and pricing. Icon upload and removal (PNG, JPG, WebP), up to eight ordered screenshots, PUT …/price (paid pricing needs the organization's Stripe Connect account). The publisher list now includes each listing's releases. promotional_text accepts 20,000 characters, and description/promotional_text widen to mediumText.
• Staff. Archive downloads (GET /v1/admin/releases/{id}/files/{engine|api|dist}), unsuspend, GET /v1/admin/review-items (R1 to R6, now enforced on approve and reject), and a listing preview on release responses.
• SPA fallback. Non-API GET paths serve public/index.html (503 when the website isn't built); the service info moves from / to GET /v1.
• registry:seed-website. Staff and publisher accounts, published demo extensions, a queued release and a draft, for the website's end-to-end tests. Refuses to run in production.

The README documents the new routes and the session model.

Testing

• Pest: 279 tests pass (was 233). Pint passes.
• Exercised end to end against a seeded local service: cookie sign-in, a 419 for unsafe requests without the XSRF header, the SPA fallback, staff archive downloads, and the full flow of publisher sign-in, token creation, staff review, approve and publish (Playwright, with the Ember prototype of the website that is not part of this PR).

Decisions to confirm

1. Image URLs. Icon and screenshot URLs come from File::url. On the private local disk they answer 403, and on S3 the objects are private, so icons/ and screenshots/ need a public-read policy or a signed or proxied route. This affects imported icons too.
2. When a request uses the session. Only when it carries the session or XSRF-TOKEN cookie, or is /v1/auth/session. Applying sessions to every request without a Bearer token would answer 419 to the CLI's login, register and verify, and to instance registration.
3. Session lifetime. The database driver with SESSION_LIFETIME (120 minutes), extended while in use. Set SESSION_SECURE_COOKIE=true behind HTTPS.
4. Members. Only existing registry accounts can be added; email invitations are not built.
5. Prices. A price change shows in the catalog at once; per the review policy, the next release goes to human review.