fix: resolve hosted auth bootstrap deadlock

[sammargolis]

Summary

• introduces token-only identity verification path for first-login bootstrap
• keeps membership-enforced auth for protected hosted routes
• bootstraps user/org/membership and sets HttpOnly session cookie after successful bootstrap

Security impact

• separates authentication from authorization to avoid deadlock while preserving authz on protected endpoints
• uses signed HttpOnly cookie for hosted session continuity

PHI handling impact

• no additional PHI persistence introduced
• audit events remain non-PHI structured records

Tests executed

• pnpm build:test
• pnpm exec tsc --project apps/web/tsconfig.json --noEmit
• pnpm test:no-phi-logs

Rollback plan

• revert this PR to return to prior auth bootstrap behavior