Fix DedupeSessionCookies panic with pgxstore (use FindCtx)

Production uses pgxstore, whose plain scs.Store.Find deliberately panics
("missing context arg") — only FindCtx works. DedupeSessionCookies called
Store.Find directly, so any request carrying duplicate session cookies
500'd (chi Recoverer caught the panic). Unit tests passed because the
in-memory store implements plain Find.

Mirror scs.doStoreFind: type-assert FindCtx(context.Context, string) and
use it with the request context, falling back to plain Find for simple
stores. Regression test adds a ctx-only store whose plain methods panic.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/api/internal/httpapi/middleware.go

@@ -377,8 +377,20 @@ func (s *Server) DedupeSessionCookies(next http.Handler) http.Handler {
 
 		chosen := ""
 		if s.Sessions != nil && s.Sessions.Store != nil {
+			// Mirror scs.doStoreFind: context-aware stores (pgxstore) implement
+			// FindCtx and their plain Find PANICS ("missing context arg").
+			find := func(tok string) bool {
+				if cs, ok := s.Sessions.Store.(interface {
+					FindCtx(context.Context, string) ([]byte, bool, error)
+				}); ok {
+					_, found, err := cs.FindCtx(r.Context(), tok)
+					return err == nil && found
+				}
+				_, found, err := s.Sessions.Store.Find(tok)
+				return err == nil && found
+			}
 			for _, tok := range tokens {
-				if _, found, err := s.Sessions.Store.Find(tok); err == nil && found {
+				if find(tok) {
 					chosen = tok
 					break
 				}