openai/gpt-chat-latest → A (3:2)

Side A delivers several lasting security and correctness improvements: voting now fails closed instead of silently falling back to an anonymous actor, auth cookies gain conditional Secure handling, OAuth mock login is gated behind an environment flag, open-redirect sanitization is tightened, and the external `durable` dependency is pinned by immutable revision. Side B fixes an important multi-user bug by removing shared browser sentinel delegates and updating the session model/tests so browser users have no delegate, but its scope is narrower than A's combination of security hardening, authentication correctness, and reproducibility improvements.