Apply code-review fixes: identity/pagination, load races, TLS pin, leaks

Addresses a multi-agent code review (26 confirmed findings + a URLSession
leak) across correctness, concurrency, security, and cleanup:

- MongoDocument.id: deterministic fallback (was UUID() on every access) to stop
  SwiftUI List/ForEach identity churn; getAll pagination drives its cursor off
  the real _id via documentId, so a missing _id stops paging instead of looping
  on a fabricated cursor.
- View models: per-load generation guard (+ captured-tab guard on ONU detail)
  so a cancelled or overlapping load can't commit stale results or land data on
  the wrong tab.
- JSONValue.intValue: guard Int(d) against NaN/inf/out-of-range (crash).
- ServerTrustEvaluator: hash the real SubjectPublicKeyInfo (prepend the
  algorithm-specific ASN.1 SPKI header) so a standard openssl-captured
  public-key pin actually matches; unknown key types fail closed.
- AppEnvironment.configure: clear stale cookies + Keychain creds on host change.
- FirmwareFile.isCompatible: empty metadata no longer passes as compatible-for-all.
- APIClient: invalidate URLSession on deinit (per-configure/probe leak).
- Dashboard best-effort sections keep last-good on transient failure; unified
  optical thresholds; LoginView prefill-once; populatedBuckets unique ForEach id;
  Format rounding rollover; dead-code/docstring/dedup cleanups.

Verification pending on the Mac (no Swift toolchain on the Linux dev box).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

APIClient.swift

@@ -47,6 +47,12 @@ final class APIClient {
         self.session = URLSession(configuration: cfg, delegate: trustDelegate, delegateQueue: nil)
     }
 
+    /// A `URLSession` created with a delegate retains that delegate (and itself)
+    /// until invalidated — Apple: an un-invalidated session "leaks memory until
+    /// it exits." This client is rebuilt on every `configure`/`probe`, so tear the
+    /// session down when the client goes away.
+    deinit { session.invalidateAndCancel() }
+
     // MARK: - Public API
 
     /// GET returning a decoded `T` from the envelope's `data`.
@@ -128,6 +134,11 @@ final class APIClient {
     /// is returned. `pageLimit` defaults to 100: full Mongo docs are ~30 KB, so
     /// larger pages (the server default is 1000) can exceed the front-end proxy
     /// timeout on big fleets. See MCMS field guide §3.3–3.4.
+    ///
+    /// `idOf` MUST return the document's real `_id` (the cursor MCMS excludes
+    /// at/before), or nil. Pass `{ $0.documentId }`, never the synthesized
+    /// `Identifiable.id` — a fabricated id is a meaningless cursor that makes the
+    /// server re-serve or skip pages. A nil id safely stops pagination.
     func getAll<T: Decodable>(
         _ endpoint: MCMSEndpoint,
         baseQuery: APIQuery = .empty,
@@ -143,7 +154,8 @@ final class APIClient {
             q.next = cursor
             let page: [T] = try await get(endpoint, query: q, as: [T].self, version: version)
             all.append(contentsOf: page)
-            cursor = page.count == pageLimit ? page.last.flatMap(idOf) : nil
+            // Stop on a short/empty page, or when the last doc has no usable `_id`.
+            cursor = (page.count == pageLimit) ? page.last.flatMap(idOf) : nil
         } while cursor != nil
         return all
     }