v0.325.0: share + escrow limiters reserve first; family sessions as fingerprints; samba renames apply; path guard widened; gates in a worktree

R-1111 reserveAttempt is the one limiter body (share password, escrow re-auth, dashboard sign-in). R-1112
family.json holds fingerprints; old files are converted at load. R-1113 the household's pass reuses its
family session. R-1109 the samba compose carries the smb.conf hash. R-1110 TestNoBareDrivePathToPathHelpers.
R-1114 shared_scripts.py resolves the felhom.eu sibling from a worktree. Each red-proved.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/web/family_gate_test.go

@@ -287,7 +287,7 @@ func TestFamilyGate_TokenOneUseBoundToHost(t *testing.T) {
 	s, st := familyHarness(t)
 	st.Add("anna")
 	sid, _ := st.NewSession("anna")
-	tok := s.mintFamilyToken("fapp.example.hu", sid, "https://fapp.example.hu/")
+	tok := s.mintFamilyToken("fapp.example.hu", family.Fingerprint(sid), "https://fapp.example.hu/")
 	if _, _, err := s.takeFamilyToken(tok, "other.example.hu"); err == nil {
 		t.Fatal("a token for another host must be refused")
 	}
@@ -297,7 +297,11 @@ func TestFamilyGate_TokenOneUseBoundToHost(t *testing.T) {
 	if _, _, err := s.takeFamilyToken(tok, "fapp.example.hu"); err == nil {
 		t.Fatal("a token must be one-use")
 	}
-	tok2 := s.mintFamilyToken("fapp.example.hu", sid, "https://fapp.example.hu/")
+	tok2 := s.mintFamilyToken("fapp.example.hu", family.Fingerprint(sid), "https://fapp.example.hu/")
+	tok3 := s.mintFamilyToken("fapp.example.hu", family.Fingerprint(sid), "https://fapp.example.hu/")
+	if w := famAsk(s, "fapp.example.hu", "GET", familyCallbackURI+"?t="+tok3, "text/html"); w.Code != http.StatusFound {
+		t.Fatalf("a token whose session holds must pass: %d", w.Code)
+	}
 	st.EndSession(sid)
 	if w := famAsk(s, "fapp.example.hu", "GET", familyCallbackURI+"?t="+tok2, "text/html"); w.Code != http.StatusForbidden {
 		t.Fatalf("a token whose session ended must be refused: %d", w.Code)