Apply code-review fixes: identity/pagination, load races, TLS pin, leaks

Addresses a multi-agent code review (26 confirmed findings + a URLSession
leak) across correctness, concurrency, security, and cleanup:

- MongoDocument.id: deterministic fallback (was UUID() on every access) to stop
  SwiftUI List/ForEach identity churn; getAll pagination drives its cursor off
  the real _id via documentId, so a missing _id stops paging instead of looping
  on a fabricated cursor.
- View models: per-load generation guard (+ captured-tab guard on ONU detail)
  so a cancelled or overlapping load can't commit stale results or land data on
  the wrong tab.
- JSONValue.intValue: guard Int(d) against NaN/inf/out-of-range (crash).
- ServerTrustEvaluator: hash the real SubjectPublicKeyInfo (prepend the
  algorithm-specific ASN.1 SPKI header) so a standard openssl-captured
  public-key pin actually matches; unknown key types fail closed.
- AppEnvironment.configure: clear stale cookies + Keychain creds on host change.
- FirmwareFile.isCompatible: empty metadata no longer passes as compatible-for-all.
- APIClient: invalidate URLSession on deinit (per-configure/probe leak).
- Dashboard best-effort sections keep last-good on transient failure; unified
  optical thresholds; LoginView prefill-once; populatedBuckets unique ForEach id;
  Format rounding rollover; dead-code/docstring/dedup cleanups.

Verification pending on the Mac (no Swift toolchain on the Linux dev box).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

AppEnvironment.swift

@@ -23,6 +23,13 @@ final class AppEnvironment {
     // MARK: Configuration
 
     func configure(_ config: APIConfiguration) {
+        // Pointing at a different server: drop the old host's session cookies and
+        // saved credentials. Keychain accounts aren't host-scoped, so leaving them
+        // would offer server A's login (and replay A's stale `sessionid`) on B.
+        if configuration?.host != config.host {
+            connection?.session.clear()
+            forgetCredentials()
+        }
         configuration = config
         connection = makeConnection(config)
         isAuthenticated = false
@@ -86,8 +93,10 @@ final class AppEnvironment {
         isAuthenticated = false
     }
 
-    /// Reachability / trust probe used by the Settings screen. Builds a
-    /// throwaway connection so testing does NOT disturb the active session.
+    /// Reachability / trust probe used by the Settings screen. Builds a throwaway
+    /// connection and issues only an unauthenticated `version()` GET. (It shares
+    /// `HTTPCookieStorage.shared` with the live session, but performs no login, so
+    /// it does not alter authenticated session state.)
     /// A 401/403/404 still means the host answered over a trusted TLS channel —
     /// that's a successful reachability result; only transport/trust errors fail.
     func probe(_ config: APIConfiguration) async throws -> String {