feat(life-call): add LM-33b panel read API

[Daisuke134]

Summary

• add five session-authenticated read-only JSON endpoints for timeline, organ scores, ledgers, context gates, and settings
• bind every PostgREST/calendar read to the LM-33a session UID and reject writes/sessionless requests
• preserve honest no-data states for PHYSICAL and the not-yet-present FIN ledger
• broaden the HttpOnly session cookie path so browsers send it to /api/panel/*
• add fixture unit coverage and a loopback five-endpoint smoke script

Verification

• node --test lib/panel-auth.test.js lib/panel-api.test.js: 20 pass, 0 fail
• npm test: 293 tests, 0 fail, exit 0
• npm run smoke:panel-api: 5/5 endpoints HTTP 200, exit 0
• node --check lib/panel-api.js and server.js: exit 0
• git diff --check: exit 0

Boundaries

• no staging or production deploy
• no write endpoint
• staging curl remains Fable L3 work per order 8b

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro

Run ID: ac99cc3b-8320-4d7f-bb7d-33c3310a2aa1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/lm33b-panel-api

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}