Initial commit of Descrybe v2 without local scratch artifacts.

Drop one-shot tmp/axe scripts and agent i18n scratch so the Gitea tree is deployable.

apps/api/internal/auth/session_version.go

@@ -0,0 +1,39 @@
+package auth
+
+import (
+	"context"
+	"errors"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5"
+)
+
+// UserSessionState is the cookie-session gate (active flag + version for revoke-on-reset).
+type UserSessionState struct {
+	Active  bool
+	Version int
+}
+
+// UserSessionState loads is_active and session_version for RequireSession.
+// When session_version is not migrated yet, Version defaults to 0 (pre-hardening sessions keep working).
+func (s *Service) UserSessionState(ctx context.Context, userID uuid.UUID) (UserSessionState, error) {
+	var st UserSessionState
+	err := s.Pool.QueryRow(ctx, `
+		SELECT is_active, session_version
+		FROM users
+		WHERE id = $1`, userID).Scan(&st.Active, &st.Version)
+	if isUndefinedColumn(err) {
+		err = s.Pool.QueryRow(ctx, `
+			SELECT is_active
+			FROM users
+			WHERE id = $1`, userID).Scan(&st.Active)
+		st.Version = 0
+	}
+	if errors.Is(err, pgx.ErrNoRows) {
+		return UserSessionState{}, ErrUserNotFound
+	}
+	if err != nil {
+		return UserSessionState{}, err
+	}
+	return st, nil
+}