fix(server): exempt authorized setup claims from attempt limits

[l1shen]

Anonymous requests to POST /auth/setup consumed the same attempt budget as setup-code authorization. This could block an already-authorized operator from claiming the deployment; even a successful setup-code request using the final allowance prevented the next step.

Require a valid signed setup session before reading the claim body, and exempt the authorized claim from the anonymous attempt counter. Missing, tampered, and expired setup sessions return 401 without consuming that counter. Claim still revalidates authorization before its atomic credential write; operator login and setup-code authorization retain their existing limits.

Add four regression cases covering valid, missing, tampered, and expired setup sessions after the authorization budget is exhausted, including repeated anonymous claim attempts before authorization. Document the claim behavior.

Validation:

• The four regression cases failed before the fix and passed afterward.
• bun run format and bun run check passed.
• bun run test passed: 1,092 tests.
• bun run build passed with existing chunk-size and mixed-import warnings.

This addresses the setup-claim availability issue in #74. The login-to-setup reproduction in that issue is prevented by existing configuration-state checks, and multi-replica deployment remains outside the supported single-container topology.

Fixes #74.

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{On-demand reviews are free for the next 16 days. After that, they cost $0.25 per reviewed file.}

Or wait 35 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used all 3 included reviews currently available. Your 44 included PR review attempts over the past 7 days set your current allowance at 3 reviews per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: 7163e899-9d69-4ff1-a757-c9333f36875c

📥 Commits

Reviewing files that changed from the base of the PR and between 2bc5c48 and d053bc3.

📒 Files selected for processing (3)

• apps/server/node/operator.ts
• apps/server/test/host.test.ts
• docs/server/container-delivery.md

---

_{Comment @coderabbitai help to get the list of available commands.}