Resolve all high-severity architecture review findings

src/ZB.MOM.WW.ScadaBridge.Security/SessionClaimBuilder.cs

@@ -11,10 +11,11 @@ namespace ZB.MOM.WW.ScadaBridge.Security;
 /// refresh to "rebuild claims identically to /auth/login".
 /// </summary>
 /// <remarks>
-/// The claim shape is exactly what the login endpoint historically minted, plus the
-/// two additions:
+/// The login and refresh paths share the following identity and session claims:
 /// <list type="bullet">
+///   <item><see cref="ClaimTypes.NameIdentifier"/> — stable antiforgery identity.</item>
 ///   <item><see cref="ClaimTypes.Name"/> — resolves <c>Identity.Name</c>.</item>
+///   <item><see cref="SessionActivityTracker.SessionIdClaim"/> — isolates activity to this login.</item>
 ///   <item><see cref="JwtTokenService.DisplayNameClaimType"/> — human display name.</item>
 ///   <item><see cref="JwtTokenService.UsernameClaimType"/> — canonical username.</item>
 ///   <item><see cref="JwtTokenService.RoleClaimType"/> — one per mapped role.</item>
@@ -64,13 +65,15 @@ public static class SessionClaimBuilder
 
         var claims = new List<Claim>
         {
+            // Antiforgery binds tokens to this stable identity, not mutable role/activity claims.
+            new(ClaimTypes.NameIdentifier, username),
             new(ClaimTypes.Name, username),
+            new(SessionActivityTracker.SessionIdClaim, Guid.NewGuid().ToString("N")),
             new(JwtTokenService.DisplayNameClaimType, displayName),
             new(JwtTokenService.UsernameClaimType, username),
             // Role-refresh anchor AND idle anchor are seeded from the same instant at
-            // build time. They then diverge: OnValidatePrincipal advances LastActivity
-            // on every request but only advances LastRoleRefresh when it actually
-            // re-runs the mapping.
+            // build time. Passive requests preserve LastActivity; accepted activity
+            // advances it. LastRoleRefresh advances when the mapping is re-run.
             new(JwtTokenService.LastRoleRefreshClaimType, refreshStamp),
             new(JwtTokenService.LastActivityClaimType, refreshStamp),
         };