Fix LinkedIn realtime auth capture

[theotarr]

Summary

• recapture LinkedIn realtime headers from one atomic /realtime/connect request after forcing a fresh Messaging navigation
• reject incomplete browser auth instead of persisting a green-but-degraded session
• reconcile stored LinkedIn sessions on refresh: repair missing readiness metadata when the keychain tuple is complete, or move incomplete sessions to needs_auth
• share one typed realtime-readiness invariant across auth capture, keychain import, validation, and daemon startup

Root cause

The auth worker subscribed after login. When login already landed on LinkedIn Messaging, the realtime request had fired before capture began, but the worker did not navigate again. It still persisted cookies and completed auth with realtimeReady: false. The keychain import/reuse path then treated those cookies as sufficient authentication and could also omit realtimeReady when importing an otherwise complete stored tuple, leaving the UI authenticated while the daemon intentionally skipped realtime startup.

User impact

New LinkedIn auth only succeeds when realtime DMs can start. Existing stored sessions self-reconcile on refresh: complete sessions are repaired without reauth; incomplete sessions show as needing authentication and can recapture the required headers.

Verification

• pnpm check:app-quality
• 518 tests passed
• swift build --package-path native/macos/CuedNative -c release
• thermonuclear maintainability review and re-review completed with no remaining findings