Diagnostic: activer l'access-log du SDK depuis l'app (toggle runtime)

Câble l'option `debugAccessLog` du SDK @ng-eventually/client dans le point
d'injection `ngSession.configure(...)`, pilotée par un toggle runtime sans
rebuild : `localStorage['festipod.debug.accessLog']==='1'` (ou
`window.__FESTIPOD_ACCESS_LOG__`), off par défaut.

But : VOIR la fuite d'isolation dans l'app RÉELLE. Le harness e2e ne peut pas la
reproduire (les lectures cross-invocation n'y rendent rien), donc on instrumente
l'app : chaque read/write du SDK s'imprime préfixé par l'identité active
(`[urn:festipod:user:<id>] READ <nuri> → N rows`), rendant visible le moment où
un doc est lu sous la mauvaise identité.

tsc propre, build OK. Outillage polyfill-era.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/shared/utils/ngSession.ts

@@ -10,7 +10,26 @@ import { configure } from "@ng-eventually/client/polyfill";
 // SDK-shaped surface used by ngSession itself — taken from the lib, not @ng-org.
 import { ng, init as initNgWeb, initNg as initNgSignals } from "@ng-eventually/client";
 
-configure({ ng: realNg, useShape: realUseShape, init: realInit, initNg: realInitNg });
+// DIAGNOSTIC (shared-wallet isolation): turn on the SDK's OFF-by-default access
+// log to SEE every read/write prefixed by the active identity — the way to catch
+// a doc read under the wrong identity in the REAL app (the e2e harness can't
+// reproduce it — cross-invocation reads return nothing there). Runtime toggle, no
+// rebuild: in the browser console run
+//   localStorage.setItem('festipod.debug.accessLog','1')   // then reload
+// (unset / '0' turns it off). Also honoured: window.__FESTIPOD_ACCESS_LOG__.
+function accessLogEnabled(): boolean {
+    try {
+        if (typeof localStorage !== "undefined"
+            && localStorage.getItem("festipod.debug.accessLog") === "1") return true;
+    } catch { /* storage may be unavailable */ }
+    return typeof window !== "undefined"
+        && (window as unknown as Record<string, unknown>).__FESTIPOD_ACCESS_LOG__ === true;
+}
+
+configure({
+    ng: realNg, useShape: realUseShape, init: realInit, initNg: realInitNg,
+    debugAccessLog: accessLogEnabled(),
+});
 
 export let session: NextGraphSession | undefined;