~anthropic/claude-sonnet-latest → A (6:4)

Side A fixes real security gaps (fail-closed vote actor resolution instead of silent anon fallback, gating mock OAuth behind an env flag, Secure cookie support, stricter open-redirect sanitization) plus adds useful nav UX, all backed by targeted unit tests. Side B is a substantial but purely cosmetic URL-format refactor (collapsing room short/slug into one path segment) bundled with an unrelated, large speculative URL-identity normalization module and many exploratory tests documenting url::Url hashing behavior, which adds bulk without clear necessity or lasting security/correctness value.