feat(web-next): resolve the session user + live compliance context

The tRPC createContext was () => ({}) — the mounted dsr/consent routers
401'd every call and the dsr singleton stub threw (audit finding A11).
createTrpcContext now accepts an app resolveUser hook; web-next resolves
the session cookie through the auth feature's validateSession (denylist
included) plus a role snapshot, and threads bindProductionDsr/Consent
(or dev-seed) bindings into every request. The dsr router resolves its
binding from ctx.dsrBinding per request instead of a throwing proxy.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

pnpm-lock.yaml

@@ -188,9 +188,18 @@ importers:
       "@repo/core-api":
         specifier: workspace:*
         version: link:../../packages/core-api
+      "@repo/core-audit":
+        specifier: workspace:*
+        version: link:../../packages/core-audit
       "@repo/core-cms":
         specifier: workspace:*
         version: link:../../packages/core-cms
+      "@repo/core-consent":
+        specifier: workspace:*
+        version: link:../../packages/core-consent
+      "@repo/core-dsr":
+        specifier: workspace:*
+        version: link:../../packages/core-dsr
       "@repo/core-shared":
         specifier: workspace:*
         version: link:../../packages/core-shared