widget: session renewal ordering and refresh-margin follow-ups after 0.4.0 #8

Problem

Follow-ups from the isolated review of the merge of main into #6 (custom headers/fetch plus identity sessions, 0.4.0). None of these blocks a release, and none can send another user's token.

1. M2: renewSession() can return an anonymous session. In packages/dewee-webchat/src/widget/api-client.ts (around ensureSession / renewSession), renewSession() reuses a /session request that is already in flight. If that request started before the host signed the user in, the widget keeps the anonymous session after sign-in. Fix: add a generation counter so that a renewal ignores, and does not join, an older in-flight load.
2. L6: headers(true) can send the stored anonymous token while a renewal is loading. loadSession sets this.session to the stored anonymous visitor before it creates the new session. A history or link call that is waiting on host headers can therefore send that anonymous token instead of waiting for the signed-in one. The impact is limited to the same browser's own visitor, and renewSession() reloads the conversation. Fix: also wait for an in-progress load, or correct the comment, which currently promises "never none or a stale one".
3. L1: the anonymous refresh margin mixes clocks. Anonymous sessions have no expiresIn, so freshness compares the server's expiresAt with the browser clock. With a short anonymous TTL and a browser clock that runs ahead, every request mints a new /session (and a Turnstile challenge). Fix: send expiresIn for anonymous sessions too.
4. L3: CORS cannot be extended. The built-in handler's Access-Control-Allow-Headers list is fixed (handler.ts), so a cross-origin endpoint cannot accept the extra headers the widget now supports.
5. L4: stale entries stay in storage. A signed-in entry stored by a 0.3.0 widget is ignored but never deleted from localStorage.

Review report (dewee repo): plans/reports/code-reviewer-261026-2104-webchat-pr6-merge-review.md. Part of nextlevelbuilder/dewee#1450.