Make backend session creation retry-safe

[epowell40]

Summary

• make /session/new idempotent per principal and client request ID
• keep empty-body creation backward compatible
• add Candidate 8 startup transport regression coverage
• regenerate source-bound certification evidence

Validation

• full public backend suite
• EPIC-0437 source certification (backend/MCP/native)
• architecture boundaries and module-size ratchet
• certification/exposure determinism
• npm audit