fix: verify all six unproven audit findings — four real, two not

The audit that produced these had every verifier agent die, so none were
confirmed. Checked each against the running system rather than guessing.

1. COOKIE Secure FLAG — REAL, fixed. The Cloudflare Tunnel runs OFF this box
   (observed source 10.30.20.67, 155 requests in the journal) and uvicorn
   only honours X-Forwarded-* from --forwarded-allow-ips, default 127.0.0.1.
   Proven by hitting the LAN IP with X-Forwarded-Proto: https and watching
   Secure vanish from Set-Cookie. Every internet visitor's session cookie
   was going out without it.
   Fixed in the unit drop-in with --proxy-headers and an allow-list scoped
   to the tunnel host — NOT "*", because trusting that header from anywhere
   would let a LAN client forge the IP the per-IP limiters key on. Verified
   both directions: trusted source + header gets Secure, plain LAN http
   correctly does not, and a spoof from an untrusted host is ignored.

2. DOUBLE GUEST ON REMOUNT — REAL but narrow, left alone. The guestAttempted
   ref already covers StrictMode's double-effect (refs survive it). The only
   hole is unmounting during the in-flight request, which needs navigating
   away and back inside ~200ms and costs one unused row. Not worth
   complicating the open door's happy path for.

3. SILENT REDIRECT WHEN RATE-LIMITED — REAL, fixed. A visitor whose guest
   provisioning was refused got bounced to /enter with no explanation — and
   at 5/hour/IP a household or cafe behind one NAT reaches that easily. The
   failure reason (the backend's own in-fiction line) now rides along in
   router state and /enter shows it, so nobody is silently handed a login
   form they never asked for.

4. RATE LIMITER KEYS NEVER EVICTED — REAL, fixed. defaultdict entries
   survived forever even once their hit list emptied. The open door made
   this materially worse: every visitor is now a real account, so every
   visitor permanently added a key across eleven limiter instances. Added an
   opportunistic sweep every 512 admitted calls — no background task, cost
   lands on whoever generates the load. Three tests; verified they catch it
   by disabling the sweep and watching one fail.

5. SUMMON RACE vs TELEMETRY — REAL, fixed. Nothing serialised summoning.
   _handle_anomaly checks `state.entity is None` then awaits a summon
   containing a multi-second LLM mint, and the ESP32's HTTP ingestion path
   calls _handle_anomaly on the SAME SeanceState — which is the entire point
   of the device integration. Both could pass the check: two entities
   minted, two essence credits, two item rolls, state.entity clobbered by
   whichever finished last. Now guarded by a per-session asyncio.Lock.

6. LEGACY ENTITIES STUCK AT DEFAULT TRAITS — mechanism REAL, zero rows
   affected here. The ALTER defaults traits to '{}' with no backfill and
   roll_traits only runs at mint, so a pre-migration spirit would read 0.5
   for everything — making `trust` always correct and `cross_over`
   unreachable. This install has 0 such rows. Added a signature-seeded
   backfill anyway, guarded to empty-traits rows so it can never touch a
   spirit that already has a real nature.

(A seventh claim from the same batch — that iOS EMF is silently dead — was
refuted earlier and deliberately left untouched.)

34 targeted tests pass; deployed and verified live.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/app/ws.py

@@ -161,6 +161,15 @@ class SeanceState:
     # Latest NOAA planetary K-index reading, refreshed on summon. Cached on
     # the state so the manifest path can report it without another lookup.
     geomagnetic: dict | None = None
+    # Serialises summoning for this session. Two independent coroutines can
+    # drive the same SeanceState: the browser's own WS message loop, and the
+    # HTTP telemetry ingestion path (device_anomaly.process_device_reading_
+    # for_summon -> _handle_anomaly), which is the entire point of the ESP32
+    # integration. Without this, both can observe `state.entity is None`,
+    # both await a summon that includes a multi-second LLM mint, and the
+    # session ends up with two entities minted, two essence credits, two
+    # item rolls, and whichever finishes last clobbering state.entity.
+    summon_lock: asyncio.Lock = field(default_factory=asyncio.Lock)
 
 
 # Active-session registry (spec: ESP32 sensor node, Workstream K): maps a
@@ -491,6 +500,13 @@ async def _reward_summon(state: SeanceState) -> None:
 
 
 async def _handle_summon(state: SeanceState) -> None:
+    # Held across the whole mint so a concurrent caller waits rather than
+    # starting a second summon. See SeanceState.summon_lock.
+    async with state.summon_lock:
+        await _summon_locked(state)
+
+
+async def _summon_locked(state: SeanceState) -> None:
     # Short-circuits: an account already over its own cap never gets far
     # enough to spend from the IP budget too.
     if not (