test(frontend): pin the attribution cursor as the only session-id source

[micio86dev]

What

FE-03 of tavus-single-session-interview. The attribution cursor, its single mutator and every reader were ALREADY merged (they came with the invisible-competency-handover work): handle.attribution.current feeds /end (both sites), /suspend, sessionId, the snapshot, the resize flush and the utterance emit; advanceAttribution flushes unsent integrity events to the outgoing row, then writes the cursor, then sends; the timer-reset watch and ProctorOverlay :session-id read the cursor-fed sessionId. So there is no refactor here: app/ is unchanged. This PR only PINS the behaviour so FE-04 can build on it safely.

• New arch spec attribution-cursor-arch.spec.ts (8 tests): advance() has one call site, in the composable; new AttributionCursor only in the composable; as AdvanceTicket only in the cursor module; createBoundaryTicket( referenced only by its own module and the composable; dbSessionId is read only as a player key; both ProctorOverlay :session-id bindings and the timer-reset watch use session.sessionId.value.
• Two tests in use-interview-session-attribution.spec.ts: the muted tape [u1(A), end, u2(muted window), u3(B)] posts exactly {(A,u1),(B,u3)}; moving the cursor posts no second /end for A.

Notes

• The literal "/end is never POSTed twice for A" (a complete followed by an endQuestion timer) fails today with 2 POSTs: the shipped HeyGen suite relies on the second POST losing with a 409 (use-interview-session.spec.ts ~l.293 and ~l.554). Deduping would change HeyGen behaviour, so only "a cursor move adds no /end" is pinned; real dedupe belongs to FE-04's assertBoundary().
• The muted-tape test models the mute in the mock provider; nothing in production mutes the uplink yet (FE-04).
• The cursor is per handle (handle.attribution), not one global cursor.current; equivalent, left as merged.

Verification

The arch tests characterise merged code, so RED came from mutations: cursor written after the send (3 tests fail), /end reading handle.dbSessionId (2 fail), a ticket minted in InterviewSession.vue (1 fails), ProctorOverlay reading session.dbSessionId (2 fail), each reverted. interview-handover.spec.ts and use-interview-session.spec.ts unmodified and green. Unit suite 115 files / 2933 tests, coverage 96.18% lines, typecheck exit 0, lint 0 errors, prettier clean; the pre-commit gate (lint-staged and gga) passed.