v0.325.0: share + escrow limiters reserve first; family sessions as fingerprints; samba renames apply; path guard widened; gates in a worktree

R-1111 reserveAttempt is the one limiter body (share password, escrow re-auth, dashboard sign-in). R-1112
family.json holds fingerprints; old files are converted at load. R-1113 the household's pass reuses its
family session. R-1109 the samba compose carries the smb.conf hash. R-1110 TestNoBareDrivePathToPathHelpers.
R-1114 shared_scripts.py resolves the felhom.eu sibling from a worktree. Each red-proved.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/web/r983_r976_test.go

@@ -17,6 +17,8 @@ import (
 	"time"
 
 	"golang.org/x/crypto/bcrypt"
+
+	"gitea.dooplex.hu/admin/felhom-controller/internal/family"
 )
 
 // R-983 (security review 2026-10-12, six remaining items) and R-976 (family and gate sessions), v0.324.0. Each test
@@ -348,8 +350,8 @@ func TestR976_AnAppCookieCannotBeLiftedIntoAnotherApp(t *testing.T) {
 		t.Fatalf("a value lifted from an app cookie minted a pass: %q", loc)
 	}
 	// the sign-in token in flight carries no session either
-	tok := s.mintFamilyToken("fapp.example.hu", sess.Value, rd)
-	if dec, _ := base64.RawURLEncoding.DecodeString(tok); strings.Contains(string(dec), sess.Value) {
+	tok := s.mintFamilyToken("fapp.example.hu", family.Fingerprint(sess.Value), rd)
+	if dec, _ := base64.RawURLEncoding.DecodeString(tok); strings.Contains(string(dec), sess.Value) || strings.Contains(string(dec), family.Fingerprint(sess.Value)) {
 		t.Fatal("the sign-in token carries the family session id")
 	}
 	// a cookie of the old shape (the session id itself, correctly signed) is refused