#4430 fix(daemon): authenticate before recording idle activity

Summary

Authenticate socket requests before daemon idle timers, admitted in-flight accounting or session activity can change. Invalid traffic can no longer keep an otherwise idle daemon alive. Preserve quiesce identity fences, valid activity and router authentication. Three files change; no scope expansion. Fixes #4420; part of #4368.

Validation

Head 5feae5ad0321905398f782e43d523672dac4d6cb; base 3924da9474eded3d40c4abbaccc79fecae894366.

• Eight runnable exact-head checks passed; exactCommit=true, checkoutChanged=false. Full-unit fallback: 19,023 Vitest passes/three skips; Node: 76 passes/six live-environment skips. Related: 323 passed. Seven selected lanes retain GitHub/manual owners. Receipt, proof and obligations.
• Real socket/lifecycle suites: 27 passed. Same final tests with base production: two failed/25 passed, including the original idle-deadline assertion; corrected production: 27 passed. Disposable experiment removed; reviewed source preserved.
• Install/build, full formatting and diff checks passed. Independent Luna review found no concrete regressions.
• Fresh PR CI/review remain pending. No live-device run is claimed for this host admission change. No budgets, fallback, selection or release behavior changed.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}