openai/gpt-chat-latest → A (4:1)

Side A replaces the project-wide `CanonicalItemUrl` string wrapper with a new `ItemId` type, introduces `item_id.rs`/`item_wire.rs`, updates reducer, ranking, routing, RPC, HTML, and tests to use structured identities, and adds `RouteContext`/`garden_item_href` integration. Side B meaningfully hardens authentication by making vote authorization fail closed, adding Secure cookie handling and redirect sanitization, but much of the patch is UI, configuration, and dependency pinning, whereas A establishes a broader, durable architectural foundation used throughout the codebase.