fix: clean stale ws_id on register, guard tile key access in filter_delta

feat: add SessionManager with single-session-per-user eviction

feat: add InterestManager for per-client chunk filtering

feat: add avatar CRUD and memory API routes

feat: add HF OAuth auth routes (login, callback, logout, me)

feat: add persistence/auth dirs and config constants