Code against the polyfill's published contract, and nothing else

The data layer is now reached through one pulled, version-pinned engagement
(`.project/concepts/data-layer/contract_polyfill-surface.md`, @1ecf511e9d).
That copy is the only reference: the provider's sources are never opened, and
what the contract does not answer is a gap raised with it, never worked around
here.

Surface
- `@ng-eventually/sdk` -> `@ng-eventually/polyfill`, one entry point.
- `configure` loses `getSession`, `normalizeId`, `currentUser`; the session
  belongs to the package and its own `init` captures it.
- Placement is named by scope alone -- a session is one user, so the app no
  longer passes an identity it had no way to obtain. This removes a constant
  that made every user collide on one owner's document.
- `init(...)` then `await ensureIdentity()`, in that order, as one sequence:
  React runs child effects first, so the two calls sat in the wrong order and
  the contract now makes that throw.
- `sessionId` relayed as `string | number`, `materialize` -> `read`.

A rejection means "unknown", never "absent"
Four places treated a caught error as an empty result. The worst wrote a
duplicate participation: an unknown count read as zero defeated the idempotence
guard of `joinEvent`. Also fixed: a per-document count, a silently dropped
notification shown optimistically anyway, and a failed listing that left the
owned-event set empty and disabled the materializer for the whole session.

Shared identity is not a Festipod notion
A browser context is one user. The per-scenario identity plant is deleted at
its source and its five sites; what stays is the deployment's wallet file,
which the contract requires an application to serve.

Documentation
The doctrine no longer describes how the data layer works underneath: five
leaves whose subject was internals are gone, a dozen more are re-founded on the
contract's own words, and two frozen arbitrations about a deleted screen were
removed rather than left to mislead a future session.

Test harness
It can sign in at last: cucumber runs under node, which does not load `.env`,
so the harness never received the wallet material and every scenario silently
fell back to an empty local mode. A failed sign-in is now loud on both sides.
The suite also releases what it opens and exits on its own -- runs were still
resident hours after reporting, holding a browser and two servers.

Known red: `@data` cannot be measured. The served wallet accumulates and
nothing resets it; moving the browser profile aside does not, since the data
lives in the wallet file, not the profile.

.env.example

@@ -1,20 +1,25 @@
 # Festipod — variables d'environnement (exemple)
 #
-# Copier en `.env` (chargé automatiquement par Bun) et renseigner les valeurs.
+# Copier en `.env` et renseigner les valeurs.
 # En dev (`bun run dev`) ET en prod (`bun run start`), l'app sert depuis src/ et
 # lit ces variables au RUNTIME (via l'endpoint /festipod-config.json de src/index.ts).
-# Sans elles, l'app tombe en mode dégradé : la barrière d'accès n'affiche que le
-# champ identifiant, sans l'assistance de chargement du portefeuille partagé.
+#
+# REQUIS POUR LES TESTS. La suite Cucumber tourne sous `node` (pas sous Bun), qui
+# ne charge pas `.env` tout seul : le harness le lit explicitement et LÈVE UNE
+# ERREUR NOMMÉE si le mot de passe ou le fichier manquent. Or `.env` ET `*.ngw`
+# sont tous deux gitignorés — un clone frais n'a donc ni l'un ni l'autre et ne
+# peut pas exécuter `@data`/`@e2e` tant que ces deux valeurs ne sont pas fournies.
 
 # ── Portefeuille partagé (stopgap staging) ─────────────────────────────────
 # Mot de passe du portefeuille partagé.
-# VIDE => hasSharedWallet() faux => la barrière n'affiche QUE le champ identifiant
-# (pas les 3 étapes « télécharger + importer le portefeuille »). REQUIS en staging
-# pour l'onboarding d'un appareil qui n'a pas encore de wallet.
+# VIDE => rien n'est passé à `configure({ sharedWallet })` => le SDK refuse de
+# signer l'entrée et l'app affiche son panneau d'erreur au lieu de démarrer.
+# REQUIS en staging (onboarding d'un appareil sans wallet) ET pour les tests.
 FESTIPOD_SHARED_WALLET_PASSWORD=
 
-# Chemin ABSOLU vers le fichier portefeuille partagé (.ngw). Servi en
-# téléchargement à /shared-wallet.ngw depuis la barrière d'accès.
+# Chemin vers le fichier portefeuille partagé (.ngw), absolu ou relatif à la
+# racine. Servi en téléchargement à /shared-wallet.ngw — par le build de l'app,
+# et par le serveur du harness pendant les tests.
 FESTIPOD_SHARED_WALLET_FILE=/chemin/absolu/vers/festipod-wallet.ngw
 
 # ── Seed automatique (opt-in) ──────────────────────────────────────────────
@@ -30,11 +35,7 @@ PORT=3000
 NODE_ENV=
 
 # ── Outillage dev (facultatif) ─────────────────────────────────────────────
-# Override du chemin local du polyfill @ng-eventually/client pour `pnpm run
-# link:polyfill` (lien local réactif). Défaut = ../nextgraph/ng-eventually-js/packages/client.
+# Override du chemin local du polyfill @ng-eventually/sdk pour `pnpm run
+# link:polyfill` (lien local réactif). Défaut = ../nextgraph/ng-eventually-js/packages/sdk.
 NG_EVENTUALLY_LOCAL=
 
-# ── Build only (build.ts / `bun run build`, PAS le runtime) ────────────────
-# ACCESS_GATE_DISABLED=1 => build SANS barrière d'accès (l'app démarre directement).
-# Réservé à un build de démo/no-gate ; ne pas utiliser pour un déploiement réel.
-ACCESS_GATE_DISABLED=