openai/gpt-chat-latest → B (3:2)

Side B introduces substantive security hardening across the authentication flow: vote submission now fails closed when no valid session exists, mock OAuth is gated behind an explicit environment flag, Secure cookie attributes are enabled for HTTPS deployments, and return-path sanitization is strengthened with accompanying tests. Side A fixes a real reducer bug by moving the zero-ratio early return ahead of `ensure_item` and `voted_pairs` registration to prevent ghost items and stale voted pairs, but its impact is narrower than the broader authentication and security improvements in Side B.