[F-668] Unify authz-check patterns across dashboard IPC modules

[jeff-roche]

Scope

Phase 3 added 73 Tauri IPC commands across 10 files. The dashboard-only commands check window-label authorization, but three different patterns coexist for what is the same intent. Cross-PR drift visible only at milestone scope.

Finding

• Locations:
  • crates/forge-shell/src/credentials_ipc.rs:111 — local authz_check() helper
  • crates/forge-shell/src/memory_ipc.rs:197 (and :233, :257, :284) — require_window_label_in(&webview, &["dashboard"], false, ...)
  • crates/forge-shell/src/containers_ipc.rs:290 — crate::ipc::require_window_label(&webview, CONTAINERS_OWNER_LABEL, ...)
  • crates/forge-shell/src/ipc.rs:1520 — require_window_label_in(&webview, &["dashboard"], true, ...) (dashboard OR session)
• Severity: high
• Concern class: IPC command shape consistency
• Estimated effort: small

All three forms emit the same LABEL_MISMATCH_ERROR and log at the same target: "forge_shell::ipc::authz". Functionally equivalent for dashboard-only commands; semantically identical. The three call shapes exist purely as accidental cross-PR drift. Each new IPC command author has had to choose which to copy.

The third boolean argument to require_window_label_in (allow_session_prefix) is also load-bearing and undocumented at call sites — false means dashboard-only, true means dashboard-or-session. Without naming this clearly, future authors will guess.

Remediation

1. Retire credentials_ipc::authz_check(). Migrate its callers to require_window_label.
2. Standardize: dashboard-only → require_window_label(&webview, "dashboard", ...); dashboard-or-session → keep require_window_label_in but rename the third arg from allow_session_prefix to allow_any_session and add a doc comment.
3. Update containers_ipc::CONTAINERS_OWNER_LABEL to use the same helper.
4. Add a single doc comment in ipc.rs documenting the two patterns and when to use each.

Definition of Done

• All dashboard IPC commands route through one of two named helpers (require_window_label for strict, require_window_label_in for permissive)
• credentials_ipc::authz_check removed
• Authz pattern documented in a top-of-file comment in ipc.rs
• cargo clippy --all-targets --all-features -- -D warnings clean
• Tests pass in CI