~anthropic/claude-sonnet-latest → B (6:4)

Side B fixes a real security bug (votes silently falling back to an anonymous actor instead of failing closed), gates a test-only OAuth bypass behind an explicit env flag, adds Secure cookie support, and pins a git dependency to a rev instead of a mutable branch—all concrete, lasting correctness/security improvements with tests. Side A is a large mechanical rename/refactor (CanonicalItemUrl -> ItemId) that improves internal typing but changes no external behavior and even leaves a stray plan.md deletion with no functional payoff beyond restructuring existing logic.