fix(sessions): disable shared session access

[pandemicsyn]

Summary

• return 404 from legacy and current shared-session pages
• return 404 from the public session-ingest endpoint without loading session data
• keep authenticated session access and sharing APIs unchanged

Verification

• pnpm --filter web typecheck
• pnpm --filter cloudflare-session-ingest typecheck
• pnpm --filter cloudflare-session-ingest lint
• pnpm --filter cloudflare-session-ingest test -- src/index.test.ts
• targeted oxfmt --check and git diff --check

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (4 files)

• apps/web/src/app/s/[sessionId]/page.tsx
• apps/web/src/app/share/[shareId]/page.tsx
• services/session-ingest/src/app.ts
• services/session-ingest/src/index.test.ts

Reviewed the shared-session disablement at commit 7d512ac. Both public pages call notFound() unconditionally with imports already present, and force-dynamic is consistent with per-request evaluation. The session-ingest public route now returns the existing session_not_found 404 shape before any database or Durable Object access; the 400-vs-404 ordering only validates UUID format and reveals nothing about session existence. In-repo consumers all use the JWT-protected /api/session/... routes, so authenticated session access and sharing APIs are unaffected. The updated test correctly asserts the database is never queried, and no memory leaks (streams, listeners, timers) are introduced — the only streaming path is now unreachable.

---

_{Reviewed by kimi-k3 · Input: 41.1K · Output: 8.5K · Cached: 261K}

_{Review guidance: REVIEW.md from base branch main}