Harden starter pilot gates

[CBruney]

Summary

• Fail closed on production auth-provider config and first-owner setup.
• Add CSRF-style protections for state-changing API routes: Origin, Fetch Metadata, and JSON content-type checks.
• Make Quick Actions fail closed unless explicitly enabled with a nonempty origin allowlist.
• Clear private browser/session caches on sign-out or access loss.
• Keep Google Contacts and Cloudflare lanes explicitly gated until their P1 readiness work is complete.
• Update docs, schema reference, package metadata posture, dev-preview rendering, and build tooling.

Verification

• npm run check
• git diff --check
• GitHub PR checks pass.
• Live Sites env revision 3 was deployed on current saved version 37.
• Live /api/session signed-out request returns 401.
• Live /api/session with caller-supplied oai-authenticated-user-email: spoofed@example.test also returns 401, confirming the supplied identity header is not accepted.

Notes

• No repo settings were changed.
• Google Contacts remains disabled in live Sites env and gated in docs.
• v0.1.0 was not changed, retagged, or recreated.
• The live deployment was an env/config application of the current saved Sites version, not a deployment of this PR branch.