feat(auth): separate anonymous entry from expired session recovery

web/workspace/test/activation-browser/activation-shell.browser.test.ts

@@ -143,11 +143,13 @@ Deno.test("activation standalone shell supports issuance, reissue, denial, resta
               path.startsWith("POST ")
             ).length;
             await go("/hosting/accounts", mode);
-            await page.getByText(
-              mode === "anonymous"
-                ? "Sign in with a hosting administrator account to issue activation codes."
-                : "Hosting administrator access is required.",
-            ).waitFor();
+            if (mode === "anonymous") {
+              await page.waitForURL("http://127.0.0.1:15381/");
+              await page.getByRole("heading", { name: "Yoi", exact: true })
+                .waitFor();
+            } else {await page.getByText(
+                "Hosting administrator access is required.",
+              ).waitFor();}
             assertEquals(
               await page.getByLabel("Account ID (handle)").count(),
               0,

web/workspace/test/activation-browser/fixture-server.ts

@@ -41,6 +41,9 @@ Deno.serve({ hostname: "127.0.0.1", port: Number(port) }, async (request) => {
   if (path === "/api/workspaces") return new Response(null, { status: 503 });
   if (path === "/api/auth/whoami") {
     return Response.json({
+      session: mode !== "anonymous"
+        ? { kind: "authenticated", expires_at: "2099-01-01T00:00:00Z" }
+        : { kind: "anonymous" },
       actor: mode === "anonymous"
         ? null
         : { ...user, auth_method: "browser_session" },