Completed /Pulse/Phase 1.2

[PacmanError404]

Phase 1 TEST walkthrough.md

• Error handling follows the shared result.ts convention.
• Session lookup re‑uses the existing BetterAuth‑based session mechanism (requirePulseSession → auth.api.getSession).
• Authorization helpers are colocated in src/lib/api/pulse.ts.
• Admin guard is strict and based solely on isAdmin(user.access).
• Host‑assignment linking is normalised, idempotent, and invoked both from the auth‑hook and as a fallback in requirePulseHost.
• Security checks (identity validation, session verification) are left untouched.
• Email sourcing is strictly from the authenticated User record; client‑provided email is never trusted.
• No modifications to CCW‑specific roles/access fields occur anywhere.