fix(api): prevent billing checkout key poisoning

[cursor]

Bug and impact

A logged-in user could be tricked into visiting /dashboard?key=<attacker-api-key>. The dashboard accepted that URL key before the session path, persisted it to browser storage, and pricing checkout then sent it as Authorization. Billing preferred the API-key header over the signed session, so a later checkout could be created for the key owner instead of the logged-in user.

Root cause

Dashboard autoload trusted a URL-supplied API key and billing resolved API-key auth before the httpOnly arch_session cookie when both were present.

Fix

• Removed dashboard ?key= API-key ingestion.
• Changed billing auth to use a valid signed session first, falling back to API-key auth only when there is no usable session.
• Added critical regression tests for both invariants.

Validation

• npx tsc --noEmit
• node tests/critical-regressions.test.mjs
• node tests/intent-funnel.test.mjs