Sign in to start and own lab sessions

Session ownership now resolves through middleware on every request. The lab and session APIs keep the same contract; Supabase replaces only the identity boundary.