feat: bind free sessions to accounts to prevent multi-account abuse

[AbhijitK20]

Summary

Prevents users from switching accounts mid-session to abuse free-tier limits. When a freebuff session becomes active, it is now bound to the authenticating user's ID. Multiple guard rails enforce this:

Changes

File	Change
cli/src/state/freebuff-session-store.ts	Added sessionBoundUserId state + setter
cli/src/hooks/use-freebuff-session.ts	Set binding on active, clear on ended/none/superseded, startup guard for mismatched users
cli/src/commands/command-registry.ts	/logout blocked during active session (requires --end-session or --force)
cli/src/hooks/use-auth-state.ts	Login rejected if new user differs from session-bound user
cli/src/data/slash-commands.ts	Updated /logout help text to document --force

How it works

1. Session binds on activation — When the poll loop receives an active status, sessionBoundUserId is set to the current user's ID from credentials.json.

2. /logout blocked — If a session is bound, /logout shows a warning and suggests /end-session first. Use /logout --force to override.

3. Login rejected on mismatch — If someone logs in as a different user while a session is bound to another account, the login is rejected and credentials are cleared.

4. Startup guard — On mount, if sessionBoundUserId exists but doesn't match the current credentials (e.g., credentials were swapped externally), the session is ended immediately.

5. Binding cleared on session end — When the session transitions to ended, none, or superseded, the binding is cleared.

Abuse scenario prevented

Before: User A logs in → gets free session → /logout → User B logs in → another free session
After:  User A logs in → gets free session → /logout blocked → must /end-session first

Notes

• Server already enforces one free session per account — this adds client-side enforcement so the same machine can't cycle through accounts
• No functional change for legitimate single-account users
• The --force flag on /logout provides an escape hatch for edge cases